generated: '2026-07-21'
method: derived
source: openapi/tictactrip-openapi-original.json
notes: >-
  Standards conformance derived from the published OpenAPI and developer docs.
  No published compliance certifications (SOC 2 / ISO 27001 / PCI / etc.) were
  found on the site, so no `Compliance` pointer is emitted.
standards:
  - id: openapi-3.0
    conforms: true
    evidence: Spec is OpenAPI 3.0.0 (title "@tictactrip/api", served at api.tictactrip.eu/documentation).
  - id: oauth2
    conforms: false
    evidence: Auth is http bearer (JWT partner token), not an OAuth2 flow.
  - id: oidc
    conforms: false
  - id: http-bearer-jwt
    conforms: true
    evidence: securityScheme "authentication" type http, scheme bearer, bearerFormat JWT.
  - id: rfc9457-problem-details
    conforms: false
    evidence: Errors use a custom { errorKey, errorMessage } JSON envelope, not application/problem+json.
  - id: pagination
    conforms: true
    evidence: GetOrders exposes page + itemsPerPage query parameters (page-number pagination).
  - id: idempotency
    conforms: false
    evidence: No Idempotency-Key header/parameter is documented in the spec.
  - id: rfc8594-sunset
    conforms: false
    evidence: No Sunset/Deprecation header support documented.
  - id: fhir-r4
    conforms: false
  - id: fapi
    conforms: false
  - id: scim
    conforms: false
  - id: odata
    conforms: false
  - id: json-api
    conforms: false