generated: '2026-07-19'
method: derived
source: openapi/get-on-board-openapi-original.yml
standards:
- id: openapi-3.0
  conforms: true
  evidence: Provider publishes an OpenAPI 3.0.3 document at /doc/openapi.yaml.
- id: oauth2
  conforms: false
  evidence: No oauth2 security schemes; auth is HTTP bearer (API key / JWT / board secret).
- id: oidc
  conforms: false
- id: rfc9457-problem-details
  conforms: false
  evidence: Errors use a custom { message, code } envelope, not application/problem+json.
- id: json-api
  conforms: partial
  evidence: >-
    Resource objects follow a JSON:API-inspired id/type/attributes/relationships
    shape, but content type is application/json (not application/vnd.api+json) and
    the full JSON:API spec (links, included, error objects) is not implemented.
- id: pagination
  conforms: true
  evidence: page/per_page params with a meta { page, per_page, total_pages } envelope.
- id: idempotency
  conforms: false
  evidence: No idempotency-key mechanism documented.
- id: webhooks
  conforms: true
  evidence: Webhook endpoint + event subscription surface (/api/v0/webhook_endpoints, /api/v0/webhook_events).
- id: rfc8594-sunset
  conforms: false
  evidence: No Deprecation/Sunset header policy documented.