generated: '2026-07-18'
method: searched
source: https://docs.butlr.io/getting-started
standards:
- id: oauth2
  conforms: true
  evidence: >-
    Docs state the API accepts JWT access tokens compliant with OAuth 2.0;
    password and client-credentials grants are documented (Auth0-backed).
- id: oauth2-client-credentials
  conforms: true
  evidence: Documented M2M client-credentials grant with scoped access tokens (audience https://butlrauth/).
- id: jwt
  conforms: true
  evidence: Access tokens are OAuth 2.0 JWT access tokens.
- id: oidc
  conforms: partial
  evidence: id_token issued on password-grant login; identity via Auth0, but no Butlr-hosted OIDC discovery document exposed.
- id: graphql
  conforms: true
  evidence: First-class GraphQL API at /api/v3/graphql with published schema docs.
- id: webhooks
  conforms: true
  evidence: Documented real-time webhook event catalog with self-service GraphQL management.
- id: rfc9457-problem-details
  conforms: false
  evidence: No application/problem+json error format documented.
- id: rfc8594-sunset-header
  conforms: unknown
  evidence: Deprecations announced via changelog with EOL dates; Sunset header support not documented.
compliance_program:
  published: false
  notes: >-
    Butlr's public marketing emphasizes privacy-by-design (100% anonymous,
    camera-free, no PII) but no public trust center or named certification
    (SOC 2 / ISO 27001 / GDPR page) was found, so no `Compliance` pointer is
    emitted. Absence of a published certification page is recorded data, not a
    claim that the company lacks controls.