generated: '2026-07-19'
method: derived
source: openapi/just-eat-uk-openapi-original.json
notes: >-
  Cross-cutting standards conformance derived from the OpenAPI security schemes,
  error responses and conventions. No published third-party compliance program
  (SOC 2 / ISO 27001 / PCI) was found on the developer surface, so no Compliance
  pointer is asserted.
standards:
- id: https-only
  conforms: true
  evidence: Description mandates HTTPS for all API calls and callbacks (port 443, valid TLS).
- id: oauth2
  conforms: false
  evidence: No oauth2 securityScheme declared.
- id: openid-connect
  conforms: true
  evidence: openIdConnect scheme (justeat_adfs) present, but scoped to internal Just Eat tools (ADFS).
- id: bearer-jwt
  conforms: true
  evidence: HTTP bearer securityScheme with bearerFormat JWT for consumer/user auth.
- id: api-key
  conforms: true
  evidence: apiKey securityScheme (JE-API-KEY in Authorization header) for partner auth.
- id: rfc9457-problem-details
  conforms: false
  evidence: Error responses use application/json / text/plain, not application/problem+json.
- id: json-api
  conforms: false
  evidence: No JSON:API media type or envelope.
- id: iso8601-datetime
  conforms: true
  evidence: All dates/times use ISO 8601 with UTC offset (DueDateWithUtcOffset).
- id: pagination
  conforms: partial
  evidence: Offset/cursor-style paging on some collection endpoints; no single platform envelope.
- id: idempotency
  conforms: false
  evidence: No Idempotency-Key contract declared.
- id: async-webhooks
  conforms: true
  evidence: Documented async webhook pattern (?callback returnUrl, 202 Accepted, status envelope).