generated: '2026-07-17'
method: derived
source: openapi/bexio-openapi.yml , authentication/bexio-authentication.yml , security/bexio-trust-center.yml
standards:
- id: oauth2
  conforms: true
  evidence: OAuth 2.0 Authorization Code flow via Keycloak realm auth.bexio.com/realms/bexio (openid-configuration).
- id: oidc
  conforms: true
  evidence: Live /.well-known/openid-configuration issuer https://auth.bexio.com/realms/bexio.
- id: rfc8414-oauth-as-metadata
  conforms: true
  evidence: /.well-known/oauth-authorization-server returns 200 (Keycloak).
- id: rfc9116-security-txt
  conforms: true
  evidence: https://www.bexio.com/.well-known/security.txt published.
- id: pagination-limit-offset
  conforms: true
  evidence: limit/offset query parameters (default 500, max 2000) across list endpoints.
- id: rate-limit-headers
  conforms: true
  evidence: RateLimit-* response headers documented (429 on exceed).
- id: rfc9457-problem-details
  conforms: false
  evidence: Errors are plain JSON with error_code/message, not application/problem+json.
- id: idempotency-key
  conforms: false
  evidence: No documented Idempotency-Key header.
- id: webhooks
  conforms: false
  evidence: bexio publishes no native webhooks or event surface.
- id: iso-27001
  conforms: true
  evidence: ISO 27001 certification claimed on https://www.bexio.com/en-CH/security (see security/bexio-trust-center.yml).
- id: gdpr
  conforms: true
  evidence: GDPR alignment plus Swiss FADP/revDSG documented on the security page.