generated: '2026-07-18'
method: derived
source: openapi/circuit-v1-openapi-original.json
note: >-
  Standards conformance derived from the OpenAPI 3.1 spec and the documented
  conventions. No published certification/compliance program (SOC 2, ISO 27001,
  PCI, HIPAA, etc.) was found, so no Compliance pointer is emitted.
standards:
- id: openapi-3.1
  conforms: true
  evidence: openapi field is 3.1.0 in both v1 and v0.2b specs
- id: http-basic-auth
  conforms: true
  evidence: securitySchemes declares http/basic (API key as username)
- id: bearer-token
  conforms: true
  evidence: docs also accept Authorization Bearer with the API key
- id: oauth2
  conforms: false
- id: oidc
  conforms: false
- id: rfc9457-problem-details
  conforms: false
  evidence: errors use a coded JSON envelope (message/code/param/url), not application/problem+json
- id: json-api
  conforms: false
- id: token-pagination
  conforms: true
  evidence: list endpoints return nextPageToken consumed via pageToken
- id: rate-limiting-429
  conforms: true
  evidence: documented per-endpoint limits signalled with HTTP 429
- id: webhooks-signed
  conforms: true
  evidence: webhook requests carry a spoke-signature header for verification
- id: idempotency
  conforms: false
  evidence: no idempotency key documented