generated: '2026-07-19'
method: derived
source: >-
  authentication/equipmentshare-authentication.yml, well-known/equipmentshare-well-known.yml,
  https://github.com/EquipmentShare/t3os-examples
# Cross-cutting standards the T3OS ERP API conforms to, derived from the published auth flows,
# the live Auth0 OIDC discovery document, and the live JWKS endpoint. No published compliance
# certification program (SOC 2 / ISO 27001 / PCI / HIPAA) was found, so no Compliance pointer.
standards:
- id: oauth2
  conforms: true
  evidence: OAuth 2.0 Authorization Code flow via Auth0 (/authorize, /oauth/token).
- id: oauth2-pkce
  conforms: true
  evidence: Reference apps hand-roll PKCE challenge/verifier for the authorization code flow (RFC 7636).
- id: oidc
  conforms: true
  evidence: Live openid-configuration at equipmentshare-erp.us.auth0.com; sign-in-only OIDC flow documented.
- id: rfc7517-jwks
  conforms: true
  evidence: Live JWKS at api.equipmentshare.com/es-erp-api/.well-known/jwks.json (RSA key set).
- id: rfc7519-jwt
  conforms: true
  evidence: Install tokens are JWTs verified against the es-erp-api JWKS (iss/aud checks).
- id: graphql
  conforms: true
  evidence: Single GraphQL endpoint es-erp-api/graphql; standard GraphQL errors[] envelope observed live.
- id: token-exchange
  conforms: true
  evidence: Auth0 tenant advertises urn:ietf:params:oauth:grant-type:token-exchange in grant_types_supported.
- id: rfc9457-problem-details
  conforms: false
  evidence: Errors use the GraphQL errors[] envelope, not application/problem+json.
- id: rfc9116-security-txt
  conforms: false
  evidence: No /.well-known/security.txt published (404 on apex and API hosts).
- id: aemp-telematics
  conforms: true
  evidence: >-
    T3 documents aggregating fleet data from AEMP-compliant OEM telematics systems
    (https://www.t3.tech/solutions/integrations).