generated: '2026-07-19'
method: derived
source: >-
  Derived from echo3D API docs (https://docs.echo3d.com/api) and the OIDC
  discovery document at api.echo3d.com/.well-known/openid-configuration.
standards:
- id: rest
  conforms: true
  evidence: Resource-oriented HTTP endpoints (query, upload, download, delete, convert, compress).
- id: json
  conforms: true
  evidence: API responses are JSON (asset objects, entry metadata).
- id: oidc
  conforms: true
  evidence: >-
    Console identity provider publishes an OpenID Connect discovery document
    (issuer https://echo3d.us.auth0.com/) with authorization/token/jwks
    endpoints and PKCE (S256) support.
- id: oauth2
  conforms: true
  evidence: >-
    OIDC provider advertises authorization_code, client_credentials,
    refresh_token, and device_code grant types (console/dashboard auth only;
    not the data-plane API).
- id: rfc9116-security-txt
  conforms: false
  evidence: No /.well-known/security.txt found on echo3D hosts.
- id: rfc9457-problem-details
  conforms: false
  evidence: Errors are plain-text/JSON messages, not application/problem+json.
- id: rfc8594-sunset-header
  conforms: false
  evidence: No deprecation/Sunset header support documented.
- id: cursor-pagination
  conforms: false
  evidence: No cursor/offset pagination documented; results filtered, not paged.
- id: webhooks
  conforms: true
  evidence: >-
    Documented outbound webhook events (Upload, Processed, Edit, Delete,
    metadata add/remove, AssetStatusUpdate) with stable JSON payloads.
notes: >-
  Derived conformance assertions only. No published third-party compliance
  program (SOC 2 / ISO 27001 / etc.) was found, so no Compliance canonical
  pointer is emitted.