generated: '2026-07-18'
method: derived
source: openapi/art-openapi.yml + https://developers.artsy.net/v2/docs
standards:
  - id: hal-hypermedia
    conforms: true
    evidence: Responses use HAL _links and _embedded (developers.artsy.net links_between_resources).
  - id: cursor-pagination
    conforms: true
    evidence: Cursor-preferred pagination with size/cursor/offset params and _links.next.
  - id: rate-limiting
    conforms: true
    evidence: Documented 5 req/s per application, HTTP 429 on exceed.
  - id: oauth2
    conforms: false
    evidence: Uses a custom XApp application token (client_id/client_secret exchange), not standard OAuth2 flows.
  - id: oidc
    conforms: false
  - id: rfc9457-problem-details
    conforms: false
    evidence: Custom {type,message,detail} error envelope, not application/problem+json.
  - id: json-api
    conforms: false
    evidence: Uses HAL rather than JSON:API.
compliance_program:
  published: false
  note: No public SOC 2 / ISO 27001 / PCI / HIPAA / FedRAMP posture found; no Compliance pointer emitted.