generated: '2026-07-20'
method: derived
source: openapi/modernfi-openapi-original.json
standards:
- id: oauth2
  conforms: true
  evidence: >-
    Documented OAuth 2.0 client_credentials flow; token endpoint at
    auth.modernfi.com/oauth/token (Auth0). OpenAPI declares a bearer scheme.
- id: oidc
  conforms: true
  evidence: >-
    auth.modernfi.com exposes /.well-known/openid-configuration (OIDC discovery)
    and /.well-known/oauth-authorization-server (RFC 8414 metadata).
- id: rfc8414-oauth-metadata
  conforms: true
  evidence: /.well-known/oauth-authorization-server returns 200 on auth host.
- id: idempotency
  conforms: true
  evidence: >-
    Idempotency-Key header (UUID v4) supported on create operations with 24h
    retention; documented at docs.modernfi.com/topics/idempotency.
- id: semver
  conforms: true
  evidence: Versioning policy follows semantic versioning (docs/topics/versioning).
- id: rfc9457-problem-details
  conforms: false
  evidence: Errors use a custom { detail } JSON envelope, not application/problem+json.
- id: json-api
  conforms: false
- id: fapi
  conforms: false
  evidence: No FAPI security profile declared despite the financial domain.
- id: fhir
  conforms: false
- id: scim
  conforms: false
- id: odata
  conforms: false
notes: >-
  Standards conformance derived from the OpenAPI, the well-known discovery
  documents, and the published developer docs. No third-party security/compliance
  certifications (SOC 2, ISO 27001, PCI DSS) were found published on a trust page,
  so no Compliance pointer is emitted.