generated: '2026-07-19'
method: derived
source: openapi/hatch-openapi-original.json
standards:
- id: oauth2
  conforms: false
  evidence: securityScheme is http bearer (API-key token), not oauth2
- id: openidconnect
  conforms: false
- id: rfc9457-problem-details
  conforms: false
  evidence: error envelope uses JSON:API error objects (errors[] with source.pointer), not application/problem+json
- id: json:api-errors
  conforms: true
  evidence: JsonErrorResponse follows the JSON:API error object shape (title, source.pointer, detail)
- id: openapi-3.0
  conforms: true
  evidence: provider publishes an OpenAPI 3.0.0 document at https://api.usehatchapp.com/v1/docs/openapi
- id: webhooks-signed
  conforms: true
  evidence: outbound webhooks are EdDSA-signed via the hatch-webhook-verification header with a published public key
- id: fhir-r4
  conforms: false
- id: fapi
  conforms: false
- id: scim2
  conforms: false
notes: >-
  Derived from the published OpenAPI and webhook docs. Hatch publishes no formal
  security certifications (SOC 2, ISO 27001, HIPAA, FedRAMP); the privacy policy
  references GDPR/CCPA legal obligations only, so no Compliance pointer is wired.