generated: '2026-07-21'
method: derived
source: openapi/shyft-customer-openapi-original.json
standards:
- id: oauth2
  conforms: false
  evidence: No oauth2 securityScheme; auth is HTTP Bearer (JWT) obtained via sign_in.
- id: oidc
  conforms: false
  evidence: No OpenID Connect discovery document served (app host returns SPA for
    /.well-known/openid-configuration).
- id: http-bearer-jwt
  conforms: true
  evidence: 'securitySchemes.bearerAuth: type http, scheme bearer.'
- id: rfc9457-problem-details
  conforms: false
  evidence: Error responses are application/json, not application/problem+json.
- id: rest-json
  conforms: true
  evidence: Resource-oriented REST over JSON with conventional HTTP verbs and status
    codes.
- id: pagination
  conforms: true
  evidence: Page-based pagination via per_page query parameter.
- id: idempotency
  conforms: false
  evidence: No documented idempotency-key mechanism for write operations.
- id: request-tracing
  conforms: true
  evidence: Responses carry an x-request-id header for correlation.