generated: '2026-07-19'
method: searched
source: https://honest.com/.well-known/openid-configuration
notes: >-
  Cross-cutting standards the honest.com agent/auth surface conforms to,
  evidenced by published discovery documents. No first-party OpenAPI is
  available, so contract-level standards (RFC 9457 errors, pagination) cannot be
  asserted. No published security/compliance certification program (SOC 2 / ISO
  27001 / PCI) was found on the store surface, so no Compliance pointer is
  emitted.
standards:
- id: oauth2
  conforms: true
  evidence: /.well-known/oauth-authorization-server (RFC 8414) advertises OAuth2 authorization server metadata.
- id: oidc
  conforms: true
  evidence: /.well-known/openid-configuration advertises an OpenID Connect provider (issuer, id_token RS256).
- id: rfc8414-oauth-authorization-server-metadata
  conforms: true
  evidence: /.well-known/oauth-authorization-server returns 200 with authorization-server metadata.
- id: oauth-pkce
  conforms: true
  evidence: code_challenge_methods_supported includes S256.
- id: ucp-universal-commerce-protocol
  conforms: true
  evidence: /.well-known/ucp merchant profile advertises UCP versions 2026-04-08 and 2026-01-23 with a shopping MCP transport.
- id: mcp-model-context-protocol
  conforms: true
  evidence: Live JSON-RPC MCP endpoint at /api/ucp/mcp (UCP shopping service).
- id: rfc9457-problem-details
  conforms: false
- id: fhir-r4
  conforms: false