generated: '2026-07-17'
method: searched
source: https://www.alloovium.com/en/developers
standards:
- id: oauth2
  conforms: true
  evidence: OAuth 2.1 authorization-code flow with PKCE, dynamic client registration, and scopes documented at /en/developers/authentication.
- id: oidc
  conforms: false
  evidence: OAuth 2.1 (authz/token/register/revoke) documented, but no OpenID Connect discovery/id_token surface.
- id: rfc9457-problem-details
  conforms: true
  evidence: Error envelope uses application/problem+json with type/title/status/detail/instance/code (RFC 7807/9457).
- id: rfc8594-sunset
  conforms: false
  evidence: No documented Sunset/Deprecation header policy.
- id: idempotency
  conforms: true
  evidence: Idempotency-Key header on POST/PATCH/PUT/DELETE with 24h retention and replay semantics.
- id: cursor-pagination
  conforms: true
  evidence: Opaque cursor keyset pagination with data/next_cursor/has_more envelope.
- id: rate-limit-headers
  conforms: true
  evidence: X-RateLimit-Limit/Remaining/Reset/Cost + Retry-After on 429.
- id: mcp
  conforms: true
  evidence: Hosted MCP server (spec 2025-06-18, Streamable HTTP) at /api/v1/mcp/.
compliance_programs:
- id: soc2-type-i
  status: in-progress
  managed_by: Vanta
- id: iso-27001
  status: in-progress
  managed_by: Vanta
notes: >-
  ISO 9001 appears in the product (Gap Register / Compliance Wizard) as a construction-quality capability
  Alloovium helps customers with — not an Alloovium corporate certification. Corporate SOC 2 Type I and
  ISO 27001 are recorded as in-progress via Vanta on the security page.