generated: '2026-07-18'
method: derived
source: openapi/arpeggi-labs-kits-openapi.yml
description: >-
  Cross-cutting standards conformance for the Kits AI API, derived from the
  OpenAPI and documented conventions. No formal compliance program (SOC 2, ISO
  27001, etc.) was found published at enrichment time, so no Compliance pointer
  is emitted.
standards:
  - id: openapi-3.0
    conforms: true
    evidence: Provider lists an openapi.json; API Evangelist captured an OpenAPI 3.0.3 spec from the docs.
  - id: http-bearer-auth
    conforms: true
    evidence: securityScheme type http, scheme bearer (Authorization header).
  - id: oauth2
    conforms: false
    evidence: API uses a static bearer API key, not OAuth 2.0 flows.
  - id: openid-connect
    conforms: false
  - id: rfc9457-problem-details
    conforms: false
    evidence: Errors return plain-text bodies, not application/problem+json.
  - id: pagination
    conforms: true
    evidence: List endpoints use page/perPage/order with a data+meta envelope.
  - id: idempotency
    conforms: false
    evidence: No idempotency-key mechanism documented.
  - id: webhooks
    conforms: false
    evidence: Job completion is polled; no webhook/event surface documented.