generated: '2026-07-18'
method: derived
source: https://www.bolna.ai/docs/api-reference
standards:
- id: oauth2
  conforms: false
  evidence: API uses a single Bearer API key (http bearer), not OAuth2 flows.
- id: openid-connect
  conforms: false
- id: rfc9457-problem-details
  conforms: false
  evidence: >-
    Error responses use a custom { error, message } envelope, not
    application/problem+json.
- id: rfc8594-sunset-header
  conforms: false
  evidence: Deprecation signalled in docs only; no Sunset/Deprecation headers documented.
- id: bearer-token-auth
  conforms: true
  evidence: Authorization Bearer API key on all endpoints.
- id: pagination
  conforms: true
  evidence: Offset pagination via page_number/page_size with total/has_more response fields.
- id: e164-phone-numbers
  conforms: true
  evidence: Contact numbers required in E.164 format (e.g. +919876543210).
- id: iso8601-datetimes
  conforms: true
  evidence: scheduled_at uses ISO 8601 with numeric UTC offset.
compliance_programs:
  published_certifications: []
  posture: >-
    Bolna does not publish named certification badges (SOC 2 / ISO 27001 / HIPAA)
    as a general trust program. Its Security & Data Handling page states data is
    encrypted in transit (TLS 1.2+) and at rest, API keys are hashed, and
    compliance applications (HIPAA, SOC 2, GDPR) are reviewed per-account for
    regulated industries. India data residency (ap-south-1) is available for
    enterprise. No Compliance pointer is emitted because no certification is
    published catalog-wide.
  docs: https://www.bolna.ai/docs/concepts/security