generated: '2026-07-20'
method: derived
source: openapi/physna-openapi-original.json
notes: >-
  Derived from the v2 OpenAPI and the public API guide. No published compliance
  program (SOC 2 / ISO 27001 / etc.) was found on a trust or security page, so
  no Compliance pointer is emitted.
standards:
- id: oauth2
  conforms: true
  evidence: components.securitySchemes.okta type oauth2 (authorizationCode + documented clientCredentials grant)
- id: oidc
  conforms: true
  evidence: okta authorization server; openid scope declared on the flow
- id: openapi-3.0
  conforms: true
  evidence: openapi 3.0.0 document served at api.physna.com/v2/spec
- id: rfc9457-problem-details
  conforms: false
  evidence: errors use application/json ErrorResponse schema, not application/problem+json
- id: pagination
  conforms: true
  evidence: list endpoints expose page (1-based) + perPage query params with PageData response block
- id: idempotency
  conforms: false
  evidence: no Idempotency-Key header or idempotency contract documented
- id: json-api
  conforms: false
- id: scim
  conforms: false
- id: fhir
  conforms: false
- id: odata
  conforms: false