generated: '2026-07-18'
method: searched
source: >-
  openapi/collate-openmetadata-openapi.yml,
  well-known/collate-openid-configuration.json,
  https://docs.open-metadata.org/latest/api-reference
description: >-
  Cross-cutting standards conformance for the OpenMetadata API, derived from the
  OpenAPI security scheme, the published OIDC/OAuth discovery documents for the
  hosted MCP server, and the JSON-schema metadata standard. Assertions are
  evidence-backed; a false value means no evidence was found (not a claim of
  non-support).
standards:
- id: oauth2
  conforms: true
  evidence: >-
    Hosted MCP server publishes /.well-known/oauth-authorization-server
    (RFC 8414) with authorization_code + refresh_token grants and PKCE S256.
- id: oidc
  conforms: true
  evidence: >-
    /.well-known/openid-configuration published (issuer .../mcp; scopes openid,
    profile, email).
- id: oauth-pkce
  conforms: true
  evidence: code_challenge_methods_supported = [S256]
- id: jwt-bearer
  conforms: true
  evidence: OpenAPI securityScheme BearerAuth (http/bearer); JWT tokens.
- id: json-schema
  conforms: true
  evidence: OpenMetadata metadata standard is defined entirely in JSON Schema (openmetadata-spec).
- id: rfc9457-problem-details
  conforms: false
  evidence: Errors use a custom {code, message} envelope, not application/problem+json.
- id: cursor-pagination
  conforms: true
  evidence: List endpoints use limit + before/after cursors with a paging object.
- id: mcp
  conforms: true
  evidence: Hosted Model Context Protocol server at https://sandbox.open-metadata.org/mcp.
- id: fhir-r4
  conforms: false
- id: scim2
  conforms: false
- id: odata
  conforms: false