generated: '2026-08-12'
method: derived
source: openapi/findigs-client-api-openapi.yml
standards:
- id: openapi-3.1
  conforms: true
  evidence: 'openapi: 3.1.0 served live at https://api.client.findigs.com/openapi.json'
- id: json-schema-2020-12
  conforms: true
  evidence: OpenAPI 3.1 dialect; components.schemas use JSON Schema 2020-12 keywords (anyOf, const, $ref)
- id: api-key-header-auth
  conforms: true
  evidence: components.securitySchemes.APIKeyHeader — type apiKey, in header, name X-API-KEY
- id: oauth2
  conforms: false
  evidence: no oauth2 securityScheme in the spec and no OAuth documented in the Client API reference
- id: oidc
  conforms: false
  evidence: /.well-known/openid-configuration returns 404 on every Findigs host
- id: rfc9457-problem-details
  conforms: false
  evidence: >-
    Errors use the FastAPI/Pydantic HTTPValidationError envelope ({"detail":[{"loc","msg","type"}]})
    and application/json, not application/problem+json
- id: rfc9116-security-txt
  conforms: false
  evidence: /.well-known/security.txt returns 404 on every host; the disclosure policy is an HTML page
- id: rfc8594-sunset-header
  conforms: false
  evidence: >-
    no Sunset or Deprecation header documented, and no operation carries deprecated true
- id: pagination
  conforms: true
  evidence: >-
    Page envelope {items,total,page,size,pages} with page (min 1, default 1) and size (min 1, max 100,
    default 50) query parameters on every collection operation
- id: idempotency
  conforms: false
  evidence: >-
    No Idempotency-Key header or equivalent in the spec or in the Client API documentation; the only
    write operations are POST /listings/ and PATCH /listings/{listing_id}
- id: webhooks
  conforms: true
  evidence: >-
    Findigs publishes a webhook event catalog with nine event_name values, a fixed JSON payload shape
    and defined retry behaviour (see asyncapi/findigs-webhooks.yml)
- id: asyncapi
  conforms: false
  evidence: no AsyncAPI document published; the webhook surface is documented in prose only
- id: fcra
  conforms: claimed
  evidence: >-
    Findigs states applicant data is handled under the Fair Credit Reporting Act and publishes CRA
    terms at https://www.findigs.com/legal/findigs-cra-terms-conditions and consumer reporting
    resources at https://www.findigs.com/consumer-reporting-resources. Self-asserted, not verified.
- id: fair-housing
  conforms: claimed
  evidence: >-
    Findigs states decisions run against each operator's own written policy criteria applied
    identically to every applicant, to support Fair Housing consistency. Self-asserted.
- id: soc2-type-ii
  conforms: claimed
  evidence: >-
    Claimed in the company-published llms.txt ("SOC 2 Type II certified, with encryption in transit
    and at rest"). NOT independently verifiable: Findigs publishes no trust center, no report request
    flow, and the /resources/trust-and-compliance URL named in its own llms.txt returns 404. No
    Compliance pointer is emitted in apis.yml on the strength of an unverifiable self-claim alone.