generated: '2026-07-17'
method: searched
source: Derived from this repo's openapi/ security schemes and conventions (conventions/twilio-conventions.yml, authentication/twilio-authentication.yml,
  errors/twilio-error-codes.yml) and Twilio's published trust/compliance posture (security/twilio-trust-center.yml, https://security.twilio.com/).
description: Which cross-cutting / industry standards Twilio's REST APIs conform to, derived from the specs and conventions in this repo. Twilio
  authenticates with HTTP Basic (Account SID + Auth Token or API Key/Secret), not OAuth2/OIDC; its error body is a custom {code,message,more_info,status}
  envelope rather than RFC 9457 problem+json; and it does not document a general idempotency-key contract. It does publish a substantial security-compliance
  program (SOC 2, ISO 27001/17/18, PCI DSS, HIPAA, GDPR).
standards:
- id: oauth2
  conforms: false
  evidence: openapi securitySchemes are http/basic (accountSid_authToken) + http/bearer (SendGrid); no oauth2 flows.
- id: oidc
  conforms: false
  evidence: no /.well-known/openid-configuration (probed 404); no openIdConnect scheme in any spec.
- id: fapi
  conforms: false
- id: mtls
  conforms: false
- id: rfc9457-problem-details
  conforms: false
  evidence: error body is application/json {code,message,more_info,status}, not application/problem+json (conventions/twilio-conventions.yml).
- id: rfc8594-sunset-header
  conforms: false
  evidence: deprecation is announced via changelog EOL notices + the Versioning and Support Lifecycle policy; Sunset headers not documented.
- id: pagination
  conforms: true
  evidence: page-based pagination with PageSize/Page/PageToken and *_uri / meta navigation fields (conventions/twilio-conventions.yml).
- id: idempotency
  conforms: false
  evidence: Twilio does not document a general idempotency-key header for the REST API (conventions/twilio-conventions.yml).
- id: webhooks
  conforms: true
  evidence: signed webhooks (X-Twilio-Signature) across products; see https://www.twilio.com/docs/usage/webhooks.
- id: scim
  conforms: false
- id: fhir
  conforms: false
- id: odata
  conforms: false
- id: json-api
  conforms: false
- id: pci-dss
  conforms: true
  evidence: Twilio is PCI DSS Level 1 compliant, meaning that we are held to the highest compliance standard and take every necessary precaution
    to protect your customer’s payment information.
  source: https://www.twilio.com/en-us/blog/products/launches/pay-generally-available.md
- id: openapi-3.2
  conforms: true
  evidence: the document declares 3.2.0
- id: rfc9457
  conforms: false
  evidence: no response declares application/problem+json
compliance_program:
  published: true
  url: https://security.twilio.com/
  certifications:
  - SOC 2
  - ISO 27001
  - ISO 27017
  - ISO 27018
  - PCI DSS
  - HIPAA
  - GDPR
  source: security/twilio-trust-center.yml
sources:
- https://www.twilio.com/en-us/blog/products/launches/pay-generally-available.md
- https://www.twilio.com/en-us/blog/insights/compliance/twiliotalks-twilios-approach-to-tackling-gdpr-html.md
- https://www.twilio.com/en-us/blog/products/launches/introducing-pay-pci-compliant-over-the-phone-payments.md
- https://www.twilio.com/en-us/blog/insights/compliance/4-letters-of-compliance-gdpr-html.md