generated: '2026-07-20'
method: derived
source: openapi/rasa-http-api-openapi.yml
standards:
  - id: openapi-3.0
    conforms: true
    evidence: HTTP API published as OpenAPI 3.0.1; Action Server as OpenAPI 3.0.2
  - id: jwt-rfc7519
    conforms: true
    evidence: JWT bearer securityScheme (HS256, user/role payload) on all endpoints
  - id: apikey-auth
    conforms: true
    evidence: TokenAuth apiKey scheme (query param `token`) on all endpoints
  - id: oauth2
    conforms: false
    evidence: no oauth2 securityScheme in the HTTP API spec
  - id: oidc
    conforms: false
  - id: rfc9457-problem-details
    conforms: false
    evidence: >-
      errors use a custom envelope (version/status/reason/message/code) with
      content-type application/json, not application/problem+json
  - id: json-api
    conforms: false
  - id: scim
    conforms: false
  - id: fhir
    conforms: false