generated: '2026-07-20'
method: derived
source: openapi/rainforest-qa-openapi-original.yml + https://www.rainforestqa.com/security
standards:
  - id: oauth2
    conforms: false
    evidence: API uses apiKey (CLIENT_TOKEN header) auth, not OAuth2.
  - id: openapi-3.0
    conforms: true
    evidence: Reference is published as OpenAPI 3.0.0 per-operation definitions.
  - id: rfc9457-problem-details
    conforms: false
    evidence: 'Errors use a custom {"error": string} JSON envelope, not application/problem+json.'
  - id: pagination
    conforms: true
    evidence: page/page_size page-number pagination on list endpoints.
  - id: idempotency
    conforms: false
    evidence: No Idempotency-Key contract documented.
  - id: webhooks
    conforms: true
    evidence: HMAC-signed run callbacks (initializing_run/before_run/after_run).
  - id: soc2
    conforms: true
    evidence: SOC 2 stated on https://www.rainforestqa.com/security
  - id: hipaa
    conforms: true
    evidence: HIPAA stated on https://www.rainforestqa.com/security