generated: '2026-07-19'
method: derived
source: openapi/higgsfield-openapi-original.json + https://docs.higgsfield.ai/docs
description: >-
  Cross-cutting standards conformance for the Higgsfield API, derived from the
  OpenAPI document and developer docs. No published compliance certifications
  (SOC 2 / ISO 27001 / etc.) were found on the site or trust page, so no
  Compliance pointer is emitted.
standards:
- id: openapi3
  conforms: true
  evidence: Public OpenAPI document served at docs.higgsfield.ai/docs/openapi.json (50 paths).
- id: oauth2
  conforms: false
  evidence: REST API uses a static API-key+secret scheme; OAuth is used only for the remote MCP server.
- id: oidc
  conforms: false
- id: rfc9457-problem-details
  conforms: false
  evidence: Errors use an async status envelope (status/request_id/error), not application/problem+json.
- id: webhooks
  conforms: true
  evidence: Per-request webhook via hf_webhook query parameter; POST callbacks on final status.
- id: json
  conforms: true
  evidence: application/json request and response bodies.
- id: rfc8594-sunset
  conforms: false
  evidence: No Sunset/Deprecation header policy published.
- id: idempotency
  conforms: false
  evidence: No idempotency-key contract documented.
- id: pagination
  conforms: false
  evidence: No list/collection endpoints in the public API.