generated: '2026-07-18'
method: searched
source: https://docs.atlar.com/docs/api
standards:
  - id: oauth2
    conforms: true
    evidence: >-
      OAuth 2.0 client_credentials + authorization_code flows documented; RFC 8414
      authorization-server metadata served at
      https://api.atlar.com/.well-known/oauth-authorization-server
  - id: oauth2-pkce
    conforms: true
    evidence: code_challenge_methods_supported [S256] in well-known metadata
  - id: oidc
    conforms: false
    evidence: no /.well-known/openid-configuration (404)
  - id: rfc9457-problem-details
    conforms: false
    evidence: errors returned as simple {status, message} JSON, not application/problem+json
  - id: rfc6902-json-patch
    conforms: true
    evidence: PATCH updates use JSON Patch format
  - id: http-etag-optimistic-concurrency
    conforms: true
    evidence: resources expose etag; updates gated by If-Match header
  - id: cursor-pagination
    conforms: true
    evidence: token/limit query params with items/nextToken response envelope
  - id: idempotency-key
    conforms: true
    evidence: Idempotency-Key header on POST/PATCH, 24h retention
  - id: rfc9116-security-txt
    conforms: false
    evidence: /.well-known/security.txt returns 404 on all hosts
  - id: rfc8594-sunset-header
    conforms: false
    evidence: versioning is uri-path; no documented Sunset/Deprecation header support
compliance_program:
  certifications: [SOC 2, ISO 27001]
  source: https://www.atlar.com/security
  trust_center: https://trust.atlar.com/