generated: '2026-07-28'
method: searched
source: >-
  Derived from the live accounts.jetblue.com discovery documents plus the
  published jetblue.com travel-agent / NDC pages. No OpenAPI exists for
  JetBlue, so no spec-derived assertions are possible.
standards:
- id: openid-connect-discovery-1.0
  conforms: true
  evidence: >-
    https://accounts.jetblue.com/.well-known/openid-configuration returns a
    valid OIDC discovery document (issuer, authorization/token/userinfo/jwks
    endpoints, claims_supported).
  source: well-known/jetblue-openid-configuration.json
- id: oauth2
  conforms: true
  evidence: authorization_code, implicit, refresh_token, password, device_code and CIBA grant types advertised.
  source: well-known/jetblue-openid-configuration.json
- id: rfc8414-oauth-authorization-server-metadata
  conforms: true
  evidence: https://accounts.jetblue.com/.well-known/oauth-authorization-server returns 200 with issuer + endpoint metadata.
  source: well-known/jetblue-oauth-authorization-server.json
- id: rfc7636-pkce
  conforms: true
  evidence: code_challenge_methods_supported = [S256].
  source: well-known/jetblue-openid-configuration.json
- id: rfc9449-dpop
  conforms: true
  evidence: dpop_signing_alg_values_supported advertised (RS256/384/512, ES256/384/512).
  source: well-known/jetblue-openid-configuration.json
- id: rfc9126-pushed-authorization-requests
  conforms: true
  evidence: pushed_authorization_request_endpoint = https://accounts.jetblue.com/oauth2/v1/par
  source: well-known/jetblue-openid-configuration.json
- id: rfc7662-token-introspection
  conforms: true
  evidence: introspection_endpoint advertised.
  source: well-known/jetblue-openid-configuration.json
- id: rfc7009-token-revocation
  conforms: true
  evidence: revocation_endpoint advertised.
  source: well-known/jetblue-openid-configuration.json
- id: rfc8628-device-authorization-grant
  conforms: true
  evidence: device_authorization_endpoint + urn:ietf:params:oauth:grant-type:device_code advertised.
  source: well-known/jetblue-openid-configuration.json
- id: openid-ciba
  conforms: true
  evidence: urn:openid:params:grant-type:ciba grant plus backchannel_token_delivery_modes_supported = [poll].
  source: well-known/jetblue-openid-configuration.json
- id: rfc7591-dynamic-client-registration
  conforms: partial
  evidence: >-
    registration_endpoint https://accounts.jetblue.com/oauth2/v1/clients is
    advertised, but it is the Okta tenant's own registration endpoint; JetBlue
    publishes no third-party client onboarding path, so it is not usable as a
    public developer surface.
  source: well-known/jetblue-openid-configuration.json
- id: fapi
  conforms: unknown
  evidence: No FAPI profile or conformance claim is published; discovery advertises no FAPI-specific metadata.
- id: iata-ndc
  conforms: partial
  evidence: >-
    https://www.jetblue.com/travel-agents/ndc names IATA New Distribution
    Capability as the interface and promises partner-only "Schema and message
    samples", but no NDC schema version and no IATA NDC certification level
    are published, so conformance cannot be verified from public sources.
- id: rfc9116-security-txt
  conforms: false
  evidence: No /.well-known/security.txt is served on www.jetblue.com, api.jetblue.com or accounts.jetblue.com.
  source: well-known/jetblue-well-known.yml
- id: rfc9457-problem-details
  conforms: unknown
  evidence: No public API or OpenAPI exists to evaluate an error envelope against.
- id: openapi
  conforms: false
  evidence: No OpenAPI or Swagger document is published on any JetBlue host (see review.yml probes and well-known/jetblue-well-known.yml).
- id: asyncapi
  conforms: false
  evidence: No event, streaming or webhook surface is published.
compliance_program:
  published: false
  note: >-
    No trust center, no SOC 2 / ISO 27001 / PCI DSS attestation and no
    compliance page were found on jetblue.com; probe-security-programs.py
    returned trust=none. No Compliance pointer is emitted.