generated: '2026-08-26'
method: searched
source: https://help.pyramidanalytics.com/
note: >-
  Assessed from Pyramid's published documentation. Pyramid publishes no OpenAPI/Swagger document at
  a public URL — the Swagger definition is generated inside each customer's own installation — so
  every entry below is evidenced against a documentation page rather than against a spec location.
  No compliance certifications (SOC 2, ISO 27001, PCI DSS, HIPAA, FedRAMP) are published on any
  public Pyramid page found in this pass, so no `Compliance` pointer is emitted in apis.yml.
conformance:
- id: oidc
  name: OpenID Connect
  conforms: true
  role: relying-party
  evidence: >-
    Pyramid integrates as an OIDC relying party for user authentication and exposes it through the
    API as /API3/authentication/authenticateUserOPENID and authenticateUserEmbedOPENID. It does NOT
    act as an OIDC provider and serves no /.well-known/openid-configuration (probed, 404 on every
    host).
  docs: https://help.pyramidanalytics.com/Content/Root/AdminClient/security/authentication/providers/OpenID%20Authentication.htm
- id: saml2
  name: SAML 2.0
  conforms: true
  role: service-provider
  evidence: >-
    Documented SAML integration with named setups for Okta, Google, AWS and Azure AD, surfaced in
    the API as /API3/authentication/authenticateUserSAML and authenticateUserEmbedSAML.
  docs: https://help.pyramidanalytics.com/Content/Root/AdminClient/security/authentication/providers/SAML%20Authentication.htm
- id: ldap
  name: LDAP / LDAPS
  conforms: true
  role: client
  evidence: Documented directory integration including LDAPS setup, used for authentication and user provisioning.
  docs: https://help.pyramidanalytics.com/Content/Root/AdminClient/security/authentication/providers/LDAPS_Setup.htm
- id: oauth2
  name: OAuth 2.0
  conforms: false
  evidence: >-
    The REST API authorizes with a Pyramid-minted "paToken" API key header, not an OAuth 2.0 bearer
    token. No authorization endpoint, no token endpoint, no scopes. /.well-known/oauth-authorization-server
    returns 404 on every host.
- id: scim
  name: SCIM 2.0
  conforms: false
  evidence: >-
    User provisioning is done through Pyramid's own access APIs driven by an IDP search
    (searchExternalUsers, createUsersFromSearch, updateUsersFromSearch), not through a SCIM
    endpoint. No urn:ietf:params:scim schema URN appears in the documentation set.
- id: rfc9457
  name: RFC 9457 Problem Details
  conforms: false
  evidence: Failed requests return a plain-text error message; success/failure is determined from the HTTP status code. No application/problem+json.
  docs: https://help.pyramidanalytics.com/Content/Root/developer/reference/APIs/REST%20API/Using%20REST.htm
- id: idempotency
  name: Idempotency keys
  conforms: false
  evidence: No idempotency key or replay-protection mechanism is documented on any method.
- id: pagination
  name: Standard pagination
  conforms: false
  evidence: No cursor/offset/limit parameters documented on any collection method.
domain_standards:
- id: odata
  name: OData (OASIS)
  conforms: true
  role: both-producer-and-consumer
  evidence: >-
    This is the domain-standard signature for Pyramid's market. Pyramid PRODUCES OData: the "OData
    Feed" function emits a URL or snippet for any discovery's result set, "in effect, turns Pyramid
    into a data source" consumable by Excel, Power BI and "any other OData compliant tools", with
    both Windows/Basic-authenticated links and Web-Token-authenticated snippets. Pyramid also
    CONSUMES OData as a generic data-flow source in Model. The feed capability is separately
    licensed. Recorded from the documentation, not from a contract — no $metadata endpoint is
    reachable because the feed lives on the customer's own installation.
  docs: https://help.pyramidanalytics.com/Content/Root/MainClient/CMS/actions/OData%20Feed.htm
  consumer_docs: https://help.pyramidanalytics.com/Content/Root/MainClient/apps/Model/Model%20Pro/Data%20Flow/Sources/Generic/ODataDatasource.htm
compliance:
  certifications_published: false
  note: >-
    No trust center and no named certification found. trust.pyramidanalytics.com and
    security.pyramidanalytics.com do not resolve; /security/ and /legal/ on the marketing site
    return 404; /.well-known/security.txt returns 404 on every host. Pyramid publishes a Security
    Hardening guide and an Application Security Overview in the help portal, which describe the
    product's own security model (four-tier role-based access: application, functional, content and
    data security) rather than the company's certification posture.
  security_docs:
  - https://help.pyramidanalytics.com/Content/Root/Guides/security/App%20Security%20Overview.htm
  - https://help.pyramidanalytics.com/Content/Root/Guides/security/Security_Hardening.htm