generated: '2026-09-18'
method: searched
source: >-
  https://docs.axonius.com/docs/manage-service-accounts, well-known/axonius-security.txt,
  https://trust.axonius.com/, https://www.axonius.com/security-program
description: >-
  Standards Axonius's public API surface and security posture demonstrably conform to, each with
  the evidence it rests on. No OpenAPI is public, so contract-level claims (JSON:API, RFC 9457,
  pagination style) are NOT asserted; the Postman minis show page[offset]/page[limit] query
  parameters and a data/attributes envelope, which is JSON:API-shaped, but a sample of six
  requests is not a conformance claim and is left as a note. Domain-standard conformance:
  the asset-management market has no declared domain standard in the contract, so none is
  recorded (reward-only; no penalty).
conformance:
- id: oauth2
  conforms: true
  detail: OAuth 2.1 client_credentials grant at /api/oauth2/token with HTTP Basic client auth and one-hour bearer tokens
  evidence: https://docs.axonius.com/docs/manage-service-accounts#using-oauth-21-authentication
- id: rfc9116
  name: security.txt
  conforms: true
  detail: PGP-signed security.txt with Contact, Expires, Encryption, Canonical, Policy, Preferred-Languages, Hiring
  evidence: well-known/axonius-security.txt (https://www.axonius.com/.well-known/security.txt)
- id: oidc
  conforms: false
  detail: no openid-configuration on any host; the OAuth option is a client-credentials exchange, not OpenID Connect
  evidence: well-known/axonius-well-known.yml
- id: rfc9457
  conforms: null
  detail: unknown — error format is documented only inside the login-gated API v2 reference
  evidence: https://docs.axonius.com/docs/axonius-rest-api
- id: json:api
  conforms: null
  detail: >-
    Postman minis use page[offset]/page[limit] and read data > attributes, which is JSON:API-shaped,
    but no media type or spec declaration is public; not asserted
  evidence: https://github.com/Axonius/postman-minis
compliance_programs:
- id: soc2
  name: SOC 2 Type 2
  evidence: https://www.axonius.com/security-program
- id: iso27001
  name: ISO 27001
  evidence: https://www.axonius.com/security-program
- id: hipaa
  name: HIPAA Security Rule / HITECH (Type 1 attestation)
  evidence: https://www.axonius.com/security-program
- id: fedramp
  name: FedRAMP
  evidence: https://trust.axonius.com/
- id: csa-star
  name: CSA STAR
  evidence: https://trust.axonius.com/
trust_center: security/axonius-trust-center.yml