generated: '2026-07-21'
method: derived
source: openapi/*.json + apidocs.workdayspend.com + security.workday.com
standards:
- id: json-api
  conforms: true
  evidence: All Strategic Sourcing services use application/vnd.api+json (JSON:API 1.0) request/response
    envelopes, resource objects, and pagination.
- id: scim-2.0
  conforms: true
  evidence: Dedicated SCIM 2.0 users API at /scim/v2 using application/scim+json (openapi/scoutrfp-scim-v2-openapi.json).
- id: oauth2
  conforms: false
  evidence: API-key header auth only (X-Api-Key + X-User-Token + X-User-Email); no oauth2 securitySchemes.
- id: oidc
  conforms: false
- id: rfc9457-problem-details
  conforms: false
  evidence: Errors use JSON:API errors[] / SCIM error schema, not application/problem+json.
- id: pagination
  conforms: true
  evidence: Cursor pagination via page[size]/page[cursor]/page[direction] with self/next/prev links.
- id: idempotency
  conforms: false
  evidence: No idempotency-key header documented or present in specs.
- id: soc2
  conforms: true
  evidence: Workday SOC 2 (security.workday.com).
- id: iso-27001
  conforms: true
  evidence: Workday ISO 27001 (security.workday.com).
- id: fedramp
  conforms: true
  evidence: Workday FedRAMP (security.workday.com).
- id: gdpr
  conforms: true
  evidence: Workday GDPR (security.workday.com).