specification: API Commons Conformance
specificationVersion: '0.1'
provider: F5
providerId: f5
generated: '2026-09-07'
method: searched
source: >-
  Derived from the four first-party contracts in openapi/, the OpenID discovery document saved to
  well-known/f5-my-openid-configuration.json, the RFC 9116 security.txt at
  https://www.f5.com/.well-known/security.txt, and the F5 compliance page at
  https://www.f5.com/company/trust-center/compliance (fetched 2026-09-07).
description: >-
  What the F5 estate demonstrably conforms to, judged from contracts and served documents rather
  than marketing prose. The honest summary is that F5 publishes real, well-formed contracts but
  almost no cross-cutting web-API standards: no OAuth 2.0 on any product API, no RFC 9457 problem
  details, no RFC 8594 Sunset headers, no standard pagination. The one OIDC surface F5 serves is
  its Salesforce-backed support portal, not a product API. F5's standards weight sits in the
  network and security domain (TLS, HTTP, QUIC, PROXY protocol) rather than in API conventions.
conformance:
  - id: openapi-3
    conforms: true
    evidence: >-
      Three first-party OpenAPI 3.x documents published by F5 — AS3 3.56.0 (OpenAPI 3.0.0) at
      github.com/F5Networks/f5-appsvcs-extension/blob/main/docs/openapi.yaml, FAST 1.26.0
      (3.0.0) at github.com/F5Networks/f5-appsvcs-templates/blob/master/docs/openapi.yml, and
      Declarative Onboarding 1.47.0 (3.0.3) at
      github.com/F5Networks/f5-declarative-onboarding/blob/main/src/schema/latest/openapi.yaml
  - id: swagger-2
    conforms: true
    evidence: >-
      NGINX Plus REST API 9.0 is published as a Swagger 2.0 document served by F5's own demo host
      at https://demo.nginx.com/swagger-ui/nginx_api.yaml and versioned in
      github.com/nginx/nginx.org at yaml/nginx_api.yaml. 71 operations, 24 paths.
  - id: json-schema
    conforms: true
    evidence: >-
      AS3, DO and FAST are declarative APIs whose request bodies are governed by published JSON
      Schema documents (F5Networks/f5-appsvcs-extension schema/latest/as3-schema.json,
      f5-declarative-onboarding src/schema/latest/base.schema.json). FAST additionally exposes the
      settings schema at runtime through GET /settings-schema.
  - id: oauth2
    conforms: false
    evidence: >-
      No securityScheme of type oauth2 appears in any of the four F5 contracts. BIG-IP APIs
      authenticate with HTTP Basic or the X-F5-Auth-Token header from
      POST /mgmt/shared/authn/login; F5 Distributed Cloud and NGINX One Console use
      "Authorization: APIToken <token>" or a P12 client certificate, per
      https://docs.nginx.com/nginx-one-console/api/authentication/
  - id: oidc
    conforms: partial
    evidence: >-
      https://my.f5.com/.well-known/openid-configuration returns HTTP 200 application/json with a
      complete OIDC discovery document (issuer https://my.f5.com, authorization/token/userinfo/
      jwks/revocation/introspection/registration endpoints, RS256). Saved verbatim to
      well-known/f5-my-openid-configuration.json. Marked partial, not true, because this
      authorizes the my.f5.com customer support portal — which runs on Salesforce Experience
      Cloud, evidenced by a scopes_supported list of Salesforce platform scopes (cdp_api,
      pardot_api, visualforce, lightning, einstein_gpt_api) — and not any F5 product API.
  - id: rfc9116-security-txt
    conforms: true
    evidence: >-
      https://www.f5.com/.well-known/security.txt returns HTTP 200 text/plain with Contact,
      Encryption, Policy, Hiring, Canonical and Expires (2027-08-31) fields. Saved verbatim to
      well-known/f5-security.txt. The f5.com apex serves the identical document.
  - id: rfc9457-problem-details
    conforms: false
    evidence: >-
      No F5 contract declares application/problem+json. The NGINX Plus API ships its own
      pre-RFC-9457 envelope (#/definitions/NginxError — error.code / error.status / error.text /
      request_id / href); AS3, FAST and DO declare no error schema at all. See
      errors/f5-problem-types.yml
  - id: rfc8594-sunset-header
    conforms: false
    evidence: >-
      No Sunset or Deprecation response header appears in any of the four contracts. F5 publishes
      product end-of-life dates as human-readable knowledge-base articles
      (https://my.f5.com/manage/s/article/K5903) rather than as runtime headers.
  - id: idempotency-key
    conforms: false
    evidence: >-
      No Idempotency-Key header or equivalent replay-protection parameter is declared in any F5
      contract. Idempotency in the F5 estate comes from declarative semantics rather than from a
      key — see conventions/f5-conventions.yml
  - id: pagination
    conforms: false
    evidence: >-
      No F5 contract declares a pagination scheme. Every collection operation across the NGINX
      Plus API, AS3, FAST and DO returns the full collection unpaged; these are per-device or
      per-tenant control planes whose collections are bounded by configuration size.
  - id: dry-run
    conforms: true
    evidence: >-
      AS3 declares a first-class rehearsal mode as the controls.dryRun query parameter
      (#/components/parameters/controlsDryRun), documented as "sends the declaration through all
      validation checks but does not attempt to deploy the configuration on the target device",
      available on POST /declare, POST /declare/{tenant}, POST /declare/{tenant}/applications and
      DELETE /declare/{tenant}/applications/{application} — that is, on the delete path as well as
      the create path. Introduced in AS3 3.30.
  - id: tls-1.3
    conforms: true
    evidence: >-
      TLSv1.3 negotiated on www.f5.com, clouddocs.f5.com and docs.nginx.com — see
      security/f5-domain-security.yml
  - id: hsts
    conforms: partial
    evidence: >-
      HSTS with max-age 31536000 on www.f5.com; absent on clouddocs.f5.com and docs.nginx.com.
      See security/f5-domain-security.yml
  - id: dnssec
    conforms: false
    evidence: Neither f5.com nor nginx.com is DNSSEC-signed — see security/f5-domain-security.yml
  - id: dmarc
    conforms: partial
    evidence: >-
      f5.com publishes DMARC p=reject; nginx.com publishes DMARC p=none, which monitors but does
      not enforce. See security/f5-domain-security.yml
  - id: soc2-type-ii
    conforms: true
    evidence: https://www.f5.com/company/trust-center/compliance names SOC 2 Type II
  - id: iso-27001
    conforms: true
    evidence: https://www.f5.com/company/trust-center/compliance names ISO 27001, ISO 27017 and ISO 27018
  - id: pci-dss
    conforms: true
    evidence: https://www.f5.com/company/trust-center/compliance names PCI DSS (Global)
  - id: hipaa
    conforms: true
    evidence: https://www.f5.com/company/trust-center/compliance names HIPAA (U.S.)
  - id: gdpr
    conforms: true
    evidence: https://www.f5.com/company/trust-center/compliance names GDPR and the EU-U.S. Data Privacy Framework
  - id: csa-star
    conforms: true
    evidence: https://www.f5.com/company/trust-center/compliance names Cloud Security Alliance (CSA) Security/STAR Certification
  - id: irap
    conforms: true
    evidence: https://www.f5.com/company/trust-center/compliance names the Australian Information Security Registered Assessors Program (IRAP)
  - id: bsi-c5
    conforms: true
    evidence: https://www.f5.com/company/trust-center/compliance names the Cloud Computing Compliance Criteria Catalogue (C5)
  - id: tisax
    conforms: true
    evidence: https://www.f5.com/company/trust-center/compliance names TISAX
  - id: dora
    conforms: true
    evidence: https://www.f5.com/company/trust-center/compliance names the Digital Operational Resilience Act (DORA)
  - id: ens
    conforms: true
    evidence: https://www.f5.com/company/trust-center/compliance names Esquema Nacional de Seguridad (ENS)
  - id: fedramp
    conforms: false
    evidence: >-
      No FedRAMP or StateRAMP authorization is named on
      https://www.f5.com/company/trust-center/compliance as fetched 2026-09-07. Recorded as an
      honest absence from that page, not as a claim about F5's government programs generally.
domain_standards:
  note: >-
    Application delivery and load balancing has no cross-vendor API standard of the kind
    domain_standard_conformance rewards — there is no SCIM, OData, FHIR or OpenRTB equivalent for
    ADC control planes, and no such shape is declared in any F5 contract. Recorded as
    not-applicable rather than invented. F5's standards footprint is in the protocols it
    implements on the data plane (HTTP/1.1, HTTP/2, HTTP/3 and QUIC, the PROXY protocol, TLS 1.3,
    and the IETF QUIC-LB draft F5 maintains an implementation of at
    github.com/F5Networks/quic-lb), not in the shape of its management APIs.
  applicable: false
  declared: []