generated: '2026-07-21'
method: derived
source: >-
  Derived from openapi/tessell-openapi-original.json; compliance claims searched on
  https://www.tessell.com/platform/security-and-compliance (2026-07-21).
standards:
- id: oauth2
  conforms: false
  evidence: >-
    The API's only securityScheme is BearerAuth (http bearer); tokens are minted from tenant API
    keys via /iam/authorize, not an OAuth 2.0 flow. The console supports SSO/identity providers,
    but no oauth2 scheme is declared in the contract.
- id: oidc
  conforms: false
  evidence: >-
    No openIdConnect securityScheme; console.tessell.com/.well-known/openid-configuration serves
    the SPA shell, not an OIDC discovery document.
- id: rfc9457-problem-details
  conforms: false
  evidence: 0 application/problem+json responses across 588 operations; errors are plain JSON.
- id: pagination
  conforms: true
  evidence: Offset pagination (page-size/page-offset) on list endpoints such as getTessellServices.
- id: idempotency
  conforms: false
  evidence: No Idempotency-Key header or idempotency contract in the OpenAPI or docs.
- id: json-api
  conforms: false
  evidence: Responses are bespoke JSON DTOs, not JSON:API documents.
- id: scim
  conforms: false
  evidence: User/persona management is bespoke (/users, /personas), not SCIM 2.0 paths.
- id: odata
  conforms: false
  evidence: No OData conventions in paths or query parameters.
- id: pci-dss
  conforms: true
  evidence: >-
    "Tessell is an independently verified holder of PCI DSS v4.1" —
    https://www.tessell.com/platform/security-and-compliance
- id: soc2
  conforms: true
  evidence: >-
    SOC 2 holder per the security-and-compliance page; Type II attestation with zero exceptions
    announced at https://www.tessell.com/blogs/tessell-soc2-type2.
- id: iso-27001
  conforms: true
  evidence: ISO 27001 holder per https://www.tessell.com/platform/security-and-compliance
- id: iso-27701
  conforms: true
  evidence: ISO/IEC 27701 holder per https://www.tessell.com/platform/security-and-compliance
- id: fedramp
  conforms: false
  evidence: >-
    "Tessell is not FedRAMP authorized" (stated on the security-and-compliance page; BYOA
    deployment inside the customer's authorized boundary is the positioning instead).