generated: '2026-07-18'
method: derived
source: >-
  openapi/astronomer-astro-openapi-original.yml + https://trust.astronomer.io
standards:
- id: openapi-3.0
  conforms: true
  evidence: openapi/astronomer-astro-openapi-original.yml declares openapi 3.0.3
- id: oauth2
  conforms: false
  evidence: >-
    No oauth2 securityScheme; the API uses http bearer (JWT) API tokens. The Astro
    CLI performs a browser OAuth login for human sessions, but the API itself is
    bearer-token authenticated.
- id: oidc
  conforms: false
- id: rfc9457-problem-details
  conforms: false
  evidence: >-
    Errors use application/json with a custom {message, requestId, statusCode,
    fieldErrors} envelope, not application/problem+json.
- id: rfc8594-deprecation-headers
  conforms: unknown
  evidence: Deprecation policy documented; Sunset/Deprecation header emission not confirmed in docs.
- id: pagination-offset-limit
  conforms: true
  evidence: List endpoints use offset/limit/sorts params and a {..., limit, offset, totalCount} envelope.
- id: rbac
  conforms: true
  evidence: Role, Team, ApiToken, and Authorization (permission groups) resources implement role-based access control.
- id: soc2
  conforms: true
  evidence: SOC 2 published on https://trust.astronomer.io
- id: pci-dss
  conforms: true
  evidence: PCI DSS published on https://trust.astronomer.io
- id: gdpr
  conforms: true
  evidence: GDPR published on https://trust.astronomer.io