generated: '2026-07-17'
method: derived
source: >-
  Derived from this repo's openapi/ security schemes and conventions
  (conventions/twilio-conventions.yml, authentication/twilio-authentication.yml,
  errors/twilio-error-codes.yml) and Twilio's published trust/compliance posture
  (security/twilio-trust-center.yml, https://security.twilio.com/).
description: >-
  Which cross-cutting / industry standards Twilio's REST APIs conform to, derived
  from the specs and conventions in this repo. Twilio authenticates with HTTP
  Basic (Account SID + Auth Token or API Key/Secret), not OAuth2/OIDC; its error
  body is a custom {code,message,more_info,status} envelope rather than RFC 9457
  problem+json; and it does not document a general idempotency-key contract. It
  does publish a substantial security-compliance program (SOC 2, ISO 27001/17/18,
  PCI DSS, HIPAA, GDPR).
standards:
  - id: oauth2
    conforms: false
    evidence: openapi securitySchemes are http/basic (accountSid_authToken) + http/bearer (SendGrid); no oauth2 flows.
  - id: oidc
    conforms: false
    evidence: no /.well-known/openid-configuration (probed 404); no openIdConnect scheme in any spec.
  - id: fapi
    conforms: false
  - id: mtls
    conforms: false
  - id: rfc9457-problem-details
    conforms: false
    evidence: error body is application/json {code,message,more_info,status}, not application/problem+json (conventions/twilio-conventions.yml).
  - id: rfc8594-sunset-header
    conforms: false
    evidence: deprecation is announced via changelog EOL notices + the Versioning and Support Lifecycle policy; Sunset headers not documented.
  - id: pagination
    conforms: true
    evidence: page-based pagination with PageSize/Page/PageToken and *_uri / meta navigation fields (conventions/twilio-conventions.yml).
  - id: idempotency
    conforms: false
    evidence: Twilio does not document a general idempotency-key header for the REST API (conventions/twilio-conventions.yml).
  - id: webhooks
    conforms: true
    evidence: signed webhooks (X-Twilio-Signature) across products; see https://www.twilio.com/docs/usage/webhooks.
  - id: scim
    conforms: false
  - id: fhir
    conforms: false
  - id: odata
    conforms: false
  - id: json-api
    conforms: false
compliance_program:
  published: true
  url: https://security.twilio.com/
  certifications: [SOC 2, ISO 27001, ISO 27017, ISO 27018, PCI DSS, HIPAA, GDPR]
  source: security/twilio-trust-center.yml