generated: '2026-07-20'
method: searched
source:
- openapi/r2-openapi.json
- https://r2.co/r2s-stance-on-security-privacy
- https://r2-api-docs.readme.io/docs/walkthrough
standards:
- id: openapi-3.0
  conforms: true
  evidence: Provider publishes OpenAPI 3.0.0 definitions per operation.
- id: jwt
  conforms: true
  evidence: Authorization uses partner-signed HS256 JWTs (RFC 7519).
- id: oauth2
  conforms: false
- id: openid-connect
  conforms: false
- id: rfc9457-problem-details
  conforms: false
  evidence: Errors use a plain JSON {error} envelope, not application/problem+json.
- id: rfc8594-sunset-header
  conforms: false
- id: webhook-hmac-signing
  conforms: true
  evidence: Callback requests carry a Content-Sha256 HMAC-SHA256 signature over the payload.
- id: pagination
  conforms: true
  evidence: List endpoints support page/per_page/sort query parameters.
- id: iso-27001
  conforms: true
  evidence: R2 holds ISO 27001:2022 certification (Stance on Security & Privacy page).
- id: kyc-aml
  conforms: true
  evidence: KYC and Enhanced Due Diligence (EDD) processes documented.