generated: '2026-07-19'
method: derived
source: openapi/hedra-web-api-openapi-original.json
standards:
- id: openapi-3.1
  conforms: true
  evidence: openapi field is 3.1.0
- id: apikey-auth
  conforms: true
  evidence: securityScheme APIKeyHeader (apiKey in header, X-API-Key)
- id: oauth2
  conforms: false
  evidence: no oauth2 securityScheme; auth is API key only
- id: oidc
  conforms: false
- id: rfc9457-problem-details
  conforms: false
  evidence: errors use a custom GenerationError envelope ({type, message}) and 422 HTTPValidationError, not application/problem+json
- id: pagination
  conforms: true
  evidence: limit/offset PagingParams + PageInfo on PagedResponse_Generation_
- id: idempotency
  conforms: false
  evidence: no Idempotency-Key header/parameter documented; pre-reserved generation_id/reserved_asset_id offer client-supplied de-duplication instead
- id: json-api
  conforms: false
- id: fhir
  conforms: false
- id: scim
  conforms: false
compliance_program:
  published: false
  note: No public trust center or named certifications (SOC 2 / ISO 27001 / HIPAA) were found for Hedra as of this pass; no Compliance pointer emitted.