generated: '2026-07-21'
method: derived
source: openapi/sadq-holding-limited-openapi-original.json + docs.sadq.sa/.well-known/
standards:
- id: oauth2
  conforms: true
  evidence: OAuth 2.0 client_credentials flow; RFC 8414 authorization-server metadata published at docs.sadq.sa/.well-known/oauth-authorization-server
- id: oidc
  conforms: true
  evidence: OIDC discovery document published at docs.sadq.sa/.well-known/openid-configuration (RS256 id_token signing)
- id: rfc8414-oauth-as-metadata
  conforms: true
  evidence: /.well-known/oauth-authorization-server present
- id: rfc9728-protected-resource-metadata
  conforms: true
  evidence: /.well-known/oauth-protected-resource present (resource https://api.sadq.sa)
- id: rfc9727-api-catalog
  conforms: true
  evidence: /.well-known/api-catalog linkset published
- id: mcp
  conforms: true
  evidence: published MCP server card (/.well-known/mcp/server-card.json) + streamable-http endpoint https://docs.sadq.sa/mcp
- id: llmstxt
  conforms: true
  evidence: /llms.txt published on docs host
- id: rfc9457-problem-details
  conforms: false
  evidence: errors use a custom errorCode/message envelope, not application/problem+json
- id: rfc9116-security-txt
  conforms: false
  evidence: no /.well-known/security.txt document served
- id: pkce
  conforms: true
  evidence: code_challenge_methods_supported includes S256 (authorization_code flow)
compliance_program: false