generated: '2026-07-24'
method: derived
source: openapi/emis-health-partner-api-openapi.json + https://docs.partner.emis-x.uk/auth/
notes: >-
  Standards conformance asserted from the OpenAPI security schemes, the live OIDC
  discovery document, and the partner auth docs. No published certification /
  compliance program (SOC 2, ISO 27001, NHS DTAC, DCB0129/0160) was verified from
  the partner portal, so no Compliance pointer is emitted.
standards:
- id: oauth2
  conforms: true
  evidence: OpenAPI declares an oauth2 authorizationCode securityScheme; docs document client_credentials, authorization_code, PKCE, and ROPC flows.
- id: oidc
  conforms: true
  evidence: Live OpenID Connect discovery document at identity.stg.emis-x.uk (.well-known/openid-configuration, HTTP 200).
- id: oauth2-pkce
  conforms: true
  evidence: Auth docs document Authorization Code Flow with PKCE for public clients.
- id: jwt-bearer
  conforms: true
  evidence: http bearer securityScheme with bearerFormat JWT; ~1h access tokens.
- id: azure-ad-b2c
  conforms: true
  evidence: Identity provider is Microsoft Entra External ID / Azure AD B2C.
- id: rfc9457-problem-details
  conforms: false
  evidence: Errors use a custom PartnerApi.Service.Model.ErrorResponse (application/json|xml), not application/problem+json.
- id: fhir-r4
  conforms: false
  evidence: Portal lists FHIR resource support as upcoming; current PAPI is a REST JSON API, no FHIR CapabilityStatement served.
- id: uk-core-fhir
  conforms: false
  evidence: No UK Core FHIR profiles claimed or served.
- id: smart-on-fhir
  conforms: false
  evidence: No /.well-known/smart-configuration served (404).
- id: json-api
  conforms: false
  evidence: Responses are bespoke EMIS Open JSON shapes, not JSON:API.
- id: pagination
  conforms: false
  evidence: No pagination parameters; change tracking is sequence/delta based.