generated: '2026-07-18'
method: derived
source: openapi/coactive-openapi-original.json
standards:
- id: oauth2
  conforms: false
  evidence: OpenAPI declares only an HTTPBearer (http/bearer) security scheme; no oauth2
    securityScheme. Tokens are obtained via a client-credentials/refresh-token exchange at
    /api/v0/login but scopes are not modeled.
- id: openid-connect
  conforms: false
- id: rfc9457-problem-details
  conforms: false
  evidence: Errors use a FastAPI { detail } envelope (application/json), not
    application/problem+json.
- id: bearer-token-auth
  conforms: true
  evidence: RFC 6750 bearer access tokens via Authorization header.
- id: openapi-3.1
  conforms: true
  evidence: Spec is OpenAPI 3.1.0 with 118 operations and 425 component schemas.
- id: pagination
  conforms: true
  evidence: limit/offset and page/per_page parameters across list endpoints.
- id: idempotency
  conforms: false
  evidence: No Idempotency-Key contract declared.
- id: soc2
  conforms: true
  evidence: SOC 2 stated on https://www.coactive.ai/security (see security/coactive-trust-center.yml).