generated: '2026-07-21'
method: derived
source: openapi/romit-openapi.yml
note: >-
  Standards conformance derived from the Romit v1 spec surface. No published
  compliance program (SOC 2 / PCI DSS / ISO 27001) survives for the defunct
  company, so no `Compliance` pointer is emitted.
standards:
  - id: oauth2
    conforms: true
    evidence: openapi securitySchemes type oauth2 (authorizationCode + clientCredentials flows)
  - id: bearer-token
    conforms: true
    evidence: access tokens presented as HTTP Bearer
  - id: rfc9457-problem-details
    conforms: false
    evidence: errors use a custom single-field `error` envelope, not application/problem+json
  - id: pagination-limit-offset
    conforms: true
    evidence: list operations accept limit/offset query params