generated: '2026-09-10'
method: derived
source: >-
  openapi/fusebit-http-api-core-openapi.yml, openapi/fusebit-http-api-integrations-openapi.yml,
  https://fivequarters.github.io/q5/release-notes/fusebit-http-api/, and live probes recorded in
  well-known/fusebit-well-known.yml and security/fusebit-domain-security.yml (2026-09-10).
provider: Fusebit
providerId: fusebit
providerIdNote: >-
  Assessed against the published contract only. No compliance or certification claim could be
  searched: every Fusebit marketing and trust surface (fusebit.io, developer.fusebit.io) is gone from
  DNS, so the absence of a certification below means "not evidenced", not "not held".
conformance:
  - id: openapi-3.0
    name: OpenAPI 3.0.0
    conforms: true
    evidence: >-
      Both published documents declare `openapi: 3.0.0` and parse. 89 operations, 96 component
      schemas, unique operationIds throughout, summaries and tags on every operation:
      https://github.com/fivequarters/q5/blob/HEAD/api/function-api/api_v2.yaml
  - id: semver
    name: Semantic Versioning 2.0
    conforms: true
    evidence: >-
      "All public releases of the Fusebit HTTP API are documented here ... HTTP API releases follow
      the Semantic Versioning 2.0 specification" —
      https://fivequarters.github.io/q5/release-notes/fusebit-http-api/
  - id: jwt
    name: 'JSON Web Token (RFC 7519)'
    conforms: true
    evidence: >-
      securitySchemes.AccessToken declares type http, scheme bearer, bearerFormat JWT in both
      documents; the Issuer/PublicKey schemas manage the signing keys and the `sub` claim is the
      subject of an Identity.
  - id: bearer-token
    name: 'OAuth 2.0 Bearer Token Usage (RFC 6750)'
    conforms: partial
    evidence: >-
      Credentials are presented as `Authorization: Bearer <jwt>`, but Fusebit answers 403 rather than
      401 for unauthenticated requests and declares no WWW-Authenticate challenge, so the transport
      convention is followed while the challenge semantics are not.
  - id: oauth2
    name: OAuth 2.0 authorization framework
    conforms: false
    evidence: >-
      No oauth2 securityScheme, no authorization/token endpoint and no scope vocabulary in either
      contract. Fusebit was a heavy CONSUMER of OAuth 2.0 on behalf of its customers -- 40 of its 80
      @fusebit-int connector packages implement third-party OAuth flows -- but its own API did not
      expose one. No scopes/ artifact is emitted for this reason.
  - id: oidc
    name: OpenID Connect
    conforms: false
    evidence: >-
      /.well-known/openid-configuration could not be served or probed on any Fusebit host (all
      NXDOMAIN, see well-known/fusebit-well-known.yml). No openIdConnect securityScheme in either spec.
  - id: rfc9457
    name: 'Problem Details for HTTP APIs (RFC 9457/7807)'
    conforms: false
    evidence: >-
      Errors use a bespoke application/json envelope { status, statusCode, message } with no `type`,
      `title`, `detail` or `instance` member and no application/problem+json media type. See
      errors/fusebit-problem-types.yml.
  - id: idempotency
    name: Idempotency-Key (draft-ietf-httpapi-idempotency-key-header)
    conforms: false
    evidence: >-
      No Idempotency-Key header is declared; the string "idempoten" does not appear in either
      contract. See conventions/fusebit-conventions.yml.
  - id: conditional-requests
    name: 'HTTP Conditional Requests / ETag (RFC 9110)'
    conforms: partial
    evidence: >-
      putStorage and deleteStorage use an ETag with a 409 "Etag Conflict" response for optimistic
      concurrency. Scoped to the two Storage write operations only; no other entity supports it.
  - id: pagination
    name: Cursor pagination
    conforms: true
    evidence: >-
      Opaque cursor pagination with `count` and `next` query parameters across v1 and v2 list
      operations, plus `sort` on v2 (dateModified | dateAdded | entityId).
  - id: async-202
    name: 'Asynchronous request-reply (202 + status polling)'
    conforms: true
    evidence: >-
      Seven v2 mutations return 202 with an OperationStatusObject and a typed OperationErrorCode enum;
      v1 task routes return 202 with a `location` header pointing at the task status URL
      (FunctionRoutes.task in openapi/fusebit-http-api-core-openapi.yml).
  - id: rfc8594-sunset
    name: 'Sunset HTTP Header (RFC 8594)'
    conforms: false
    evidence: >-
      No Sunset or Deprecation header and no deprecation policy. The API was retired without either.
      See lifecycle/fusebit-lifecycle.yml.
  - id: rate-limit-headers
    name: 'RateLimit header fields (draft-ietf-httpapi-ratelimit-headers)'
    conforms: false
    evidence: >-
      429 is declared and its trigger documented (task-route maxPending), but no RateLimit-*,
      X-RateLimit-* or Retry-After response header appears in either contract.
  - id: scim
    name: 'SCIM (System for Cross-domain Identity Management)'
    conforms: false
    evidence: >-
      Fusebit manages users, clients and identities on its own bespoke shapes (User, Client, Identity,
      AccessStatement). No urn:ietf:params:scim:schemas:* URN appears in either contract, and no
      /scim/v2 surface exists. Recorded because identity management is the closest thing this
      developer-tools provider has to a domain standard.
domain_standard:
  applicable: false
  note: >-
    Embedded iPaaS / developer-integration platforms have no cross-vendor interchange standard for the
    control plane an integration platform exposes -- there is no OpenRTB, FHIR or ISO 20022 equivalent
    for "manage my integrations". Fusebit is therefore not penalised for the absence of a domain
    standard, and none is invented to fill the slot. Its OAuth 2.0 work was standards-conformant but
    sat on the CONSUMING side of its connectors, not in its own published contract.
certifications:
  published: []
  note: >-
    No SOC 2, ISO 27001, PCI DSS, HIPAA or FedRAMP claim could be verified. Fusebit published no trust
    center that survives and no /.well-known/security.txt is servable on any host. No Compliance
    pointer is emitted: an unverifiable certification is not a published one.