generated: '2026-07-19'
method: searched
source: https://docs.extend.com/reference/authentication
standards:
- id: oauth2
  conforms: true
  evidence: >-
    Documented OAuth2 client-credentials flow; openid-configuration advertises token,
    authorization, introspection, and jwks endpoints (grant_types client_credentials).
- id: oauth2-client-credentials
  conforms: true
  evidence: grant_type=client_credentials against /auth/oauth/token
- id: idempotency
  conforms: true
  evidence: X-Idempotency-Key header required on idempotent create/update calls
- id: pagination
  conforms: true
  evidence: page-based pagination with default page size 25 on list/search endpoints
- id: header-versioning
  conforms: true
  evidence: Accept-header date versioning (application/json;version=YYYY-MM-DD)
- id: webhooks
  conforms: true
  evidence: outbound claim-status and service-order webhooks documented
- id: openid-connect
  conforms: false
  evidence: >-
    Exposes an openid-configuration document but only client_credentials machine-to-machine
    grants; not a user-facing OIDC login provider.
- id: rfc9457-problem-details
  conforms: false
  evidence: no application/problem+json error envelope documented