generated: '2026-07-21'
method: derived
source: openapi/templafy-public-api-v3-openapi.json
note: >-
  Cross-cutting standards conformance derived from the Public API v3 OpenAPI, plus published
  compliance posture from the Templafy security pages.
standards:
- id: openapi-3.0
  conforms: true
  evidence: Public API published as OpenAPI 3.0.3 (v1-v4 + unstable).
- id: http-bearer-auth
  conforms: true
  evidence: securitySchemes bearerAuth type http, scheme bearer, bearerFormat "API Key".
- id: oauth2
  conforms: false
  evidence: No oauth2 security scheme declared; auth is a static API key sent as a bearer token.
- id: oidc
  conforms: false
- id: rfc7807-9457-problem-details
  conforms: true
  evidence: Error responses use ProblemDetails schemas (type/title/status/detail/instance/traceId).
- id: pagination
  conforms: true
  evidence: List operations use pageNumber/pageSize query parameters.
- id: scim2
  conforms: true
  evidence: Templafy supports SCIM 2.0 user/group provisioning alongside the Public API (Admin Center API Keys grant SCIM scopes).
- id: json-api
  conforms: false
- id: idempotency
  conforms: false
  evidence: No idempotency-key mechanism documented or present in the spec.
compliance:
- SOC 2
- ISO 27001
- ISO 27017
- GDPR
compliance_docs: https://www.templafy.com/home/platform/security/