generated: '2026-07-18'
method: derived
source: openapi/demisto-openapi-original.json
note: >-
  Cross-cutting standards conformance for the Demisto / Cortex XSOAR REST API, derived from the
  swagger. Demisto uses API-key auth (no OAuth2/OIDC) and a non-standard JSON error body.
standards:
- id: oauth2
  conforms: false
  evidence: securityDefinitions declare only apiKey schemes (Authorization, X-XSRF-TOKEN, x-xdr-auth-id).
- id: oidc
  conforms: false
- id: rfc9457-problem-details
  conforms: false
  evidence: error responses use a plain application/json body, not application/problem+json.
- id: json-api
  conforms: false
- id: odata
  conforms: false
- id: scim
  conforms: false
- id: openapi
  conforms: true
  evidence: Provider publishes a Swagger 2.0 document (server_api_swagger.json) generating demisto-py.
- id: pagination
  conforms: true
  evidence: Search endpoints accept page/size and return a total count.
- id: idempotency
  conforms: false
  evidence: No idempotency-key contract documented.