generated: '2026-07-21'
method: derived
source: openapi/release-openapi-original.json
notes: Cross-cutting standards posture. Derived from the Platform API OpenAPI plus the published security page. Release authenticates
  with apiKey headers (not OAuth2/OIDC), uses a custom JSON error envelope (not RFC 9457), and page-number pagination.
standards:
- id: openapi-3.0
  conforms: true
  evidence: Provider publishes a canonical OpenAPI 3.0.3 contract at https://api.release.com/openapi.json
- id: oauth2
  conforms: false
  evidence: securitySchemes are apiKey (X-User-Email + X-User-Token), no oauth2 flows
- id: oidc
  conforms: false
- id: rfc9457-problem-details
  conforms: false
  evidence: error envelope is a plain JSON object with error/message/errors fields, not application/problem+json
- id: pagination
  conforms: true
  evidence: page-number pagination via page and per_page query params on list endpoints
- id: idempotency
  conforms: false
  evidence: no Idempotency-Key contract documented
- id: soc2
  conforms: true
  evidence: SOC 2 compliance stated on https://release.com/legal/security (see security/release-trust-center.yml)