generated: '2026-07-20'
method: searched
source: https://docs.nomos.energy/api-references/authentication
standards:
- id: oauth2
  conforms: true
  evidence: 'OAuth 2.0 (RFC 6749) with client_credentials, authorization_code, refresh_token grants documented and /oauth/token + /oauth/authorize endpoints.'
- id: rfc6749-oauth2
  conforms: true
  evidence: 'Docs cite RFC 6749 §4.4 (client credentials) and §3.3 (scope).'
- id: rfc7636-pkce
  conforms: true
  evidence: 'Authorization code flow supports PKCE with code_challenge_method S256/plain.'
- id: rfc8414-oauth-authorization-server-metadata
  conforms: true
  evidence: '/.well-known/oauth-authorization-server returns 200 with issuer, endpoints, grant_types_supported, code_challenge_methods_supported.'
- id: jwt-bearer
  conforms: true
  evidence: 'Access tokens are JWT bearer (securitySchemes.Bearer bearerFormat JWT).'
- id: cursor-pagination
  conforms: true
  evidence: 'All list endpoints use opaque cursor pagination (limit/cursor, has_more/next_page).'
- id: rfc9457-problem-details
  conforms: false
  evidence: 'Errors use a custom {code,message,requestId,docs} envelope, not application/problem+json.'
- id: openid-connect
  conforms: false
  evidence: 'No OIDC discovery document; /.well-known/openid-configuration is a 401 API catch-all, not OIDC metadata.'
- id: iso8601-datetimes
  conforms: true
  evidence: 'Timestamps and date filters use ISO 8601 with timezone.'
compliance_program: null
note: >-
  Standards conformance is derived from the docs + spec. No published security
  certifications (SOC 2 / ISO 27001 / etc.) were found, so no Compliance
  pointer is emitted.