generated: '2026-07-18'
method: derived
source: openapi/appzen-autonomous-ap-openapi-original.yml
notes: >-
  Standards conformance derived from the Autonomous AP Swagger 2.0 spec and the
  published API guidelines. AppZen uses API-key header auth (no OAuth2/OIDC in
  the spec) and a custom error envelope (not RFC 9457).
standards:
- id: openapi
  conforms: true
  evidence: Swagger 2.0 specification published at api-docs.appzen.com
- id: oauth2
  conforms: false
  evidence: securitySchemes are apiKey headers only (x-api-key, customer-id, customer-key)
- id: oidc
  conforms: false
- id: rfc9457-problem-details
  conforms: false
  evidence: 4xx/5xx use a custom {timestamp,status,error,message} envelope, application/json
- id: rfc6585-rate-limiting
  conforms: true
  evidence: documented HTTP 429 on rate-limit breach (1000 req/sec, 300000 req/day)
- id: json-api
  conforms: false
- id: scim
  conforms: false
- id: fhir
  conforms: false
- id: odata
  conforms: false
- id: idempotency
  conforms: false
  evidence: no idempotency-key header documented in spec or guidelines