generated: '2026-07-18'
method: derived
source:
  - openapi/archal-openapi-original.json
  - https://docs.archal.ai/guides/authentication
standards:
  - id: openapi-3.1
    conforms: true
    evidence: openapi field is 3.1.0
  - id: oauth2-device-authorization-grant
    conforms: true
    evidence: >
      /auth/device + /auth/device/token implement the RFC 8628 device flow
      (device_code, user_code, verification_uri, verification_uri_complete, expires_in,
      interval, 428 pending).
  - id: rfc6750-bearer-token
    conforms: true
    evidence: securityScheme archalToken is http bearer (Authorization header)
  - id: idempotency-key
    conforms: true
    evidence: Idempotency-Key header parameter on POST /api/sessions
  - id: rfc9457-problem-details
    conforms: false
    evidence: errors use a custom application/json envelope (error/code/message/detail), not problem+json
  - id: oauth2-scopes
    conforms: false
    evidence: no oauth2 authorization-code/client-credentials scopes; auth is bearer token + route apiKey
  - id: json-api
    conforms: false
  - id: fhir-r4
    conforms: false
  - id: scim-2.0
    conforms: false
  - id: fapi
    conforms: false
compliance_program:
  published: false
  note: >
    Archal publishes a Security page describing credential handling, clone isolation, and
    telemetry, but no named third-party certification (SOC 2 / ISO 27001 / PCI / HIPAA /
    FedRAMP) was found as of 2026-07-18. No Compliance pointer emitted.
  security_docs: https://docs.archal.ai/security