generated: '2026-07-19'
method: searched
source: https://platform.humanity.com/docs/getting-started-with-authentication
standards:
- id: oauth2
  conforms: true
  evidence: >-
    Humanity v2 API authenticates via OAuth2 (RFC 6749) using password and
    refresh_token grants against https://www.humanity.com/oauth2/token.php;
    bearer access tokens with expires_in and refresh_token.
- id: oauth2-bearer-token
  conforms: true
  evidence: >-
    Access tokens are presented as RFC 6750 Bearer tokens in the Authorization
    header (also accepted as an access_token query parameter).
- id: rest
  conforms: true
  evidence: >-
    Resource-oriented HTTP API using GET/PUT/POST/DELETE over /api/v2 resources
    (employees, tasks, reports, skills, shifts).
- id: openid-connect
  conforms: false
  evidence: No OIDC discovery document or id_token issuance documented.
- id: rfc9457-problem-details
  conforms: false
  evidence: No application/problem+json error contract published in the docs.
- id: rfc8594-sunset
  conforms: false
  evidence: No Sunset/Deprecation header policy documented.
compliance_note: >-
  This file asserts cross-cutting technical standards derived from the public
  docs. No published SOC 2 / ISO 27001 / HIPAA certification page was located
  for the Humanity product line during enrichment, so no Compliance pointer is
  emitted. Humanity is owned by TCP Software (TimeClock Plus, LLC).