generated: '2026-07-18'
method: derived
source: openapi/diligent-openapi-original.json
docs: https://www.godiligent.ai/security
standards:
  - id: apikey-auth
    conforms: true
    evidence: openapi securityScheme xApiKey (apiKey in header, X-API-KEY)
  - id: oauth2
    conforms: false
    evidence: no oauth2 securityScheme declared
  - id: oidc
    conforms: false
    evidence: SSO via OKTA is documented for the app, but the API uses X-API-KEY
  - id: rfc9457-problem-details
    conforms: false
    evidence: 4xx/5xx use a custom {error} envelope, not application/problem+json
  - id: webhooks-hmac
    conforms: true
    evidence: webhook payloads signed with a shared secret, delivered in X-Signature header
  - id: idempotency
    conforms: true
    evidence: idempotency-key request header on POST /cdds; 409 Conflict on key reuse with different payload
  - id: pagination
    conforms: true
    evidence: page_size query parameter on list endpoints
  - id: soc2-type2
    conforms: true
    evidence: SOC 2 Type II certification published on godiligent.ai/security and trust.godiligent.ai
  - id: iso-27001
    conforms: true
    evidence: ISO 27001 certification published on godiligent.ai/security and trust.godiligent.ai
  - id: gdpr
    conforms: true
    evidence: GDPR compliance published on godiligent.ai/security