generated: '2026-07-20'
method: derived
source: openapi/passbase-verification-openapi.yml
note: >-
  Cross-cutting standards conformance derived from the reconstructed Verifications
  API v2 OpenAPI. No published compliance program (SOC 2 / ISO 27001) could be
  verified post-acquisition, so no Compliance pointer is emitted.
standards:
  - id: oauth2
    conforms: false
    evidence: securityScheme is apiKey (X-API-KEY), not oauth2
  - id: oidc
    conforms: false
  - id: api-key-auth
    conforms: true
    evidence: apiKey header X-API-KEY securityScheme, applied globally
  - id: cursor-pagination
    conforms: true
    evidence: list operations use limit + opaque cursor.next tokens
  - id: rfc9457-problem-details
    conforms: false
    evidence: errors returned as conventional HTTP status + application/json, not problem+json
  - id: json-api
    conforms: false
  - id: rest
    conforms: true
    evidence: resource-oriented paths, GET verbs, JSON representations