generated: '2026-07-21'
method: derived
source: openapi/vicai-openapi-original.json + https://www.vic.ai/trust-and-security
standards:
- id: oauth2-client-credentials
  conforms: true
  evidence: POST /v0/token exchanges client_id+client_secret for a Bearer JWT (expires_in 3600); rate
    limit per OAuth client id
- id: http-bearer-jwt
  conforms: true
  evidence: securitySchemes.BearerAuth http/bearer; access_token is JWT
- id: cursor-pagination
  conforms: true
  evidence: PagingCursor/PagingLimit params; X-next response field
- id: webhooks
  conforms: true
  evidence: Webhook Subscriptions + Webhook Events; documented event catalog
- id: rfc9457-problem-details
  conforms: false
  evidence: errors are custom {code,message}/{field,message} JSON, not application/problem+json
- id: soc2-type-ii
  conforms: true
  evidence: SOC 1 & SOC 2 Type II, third-party audited annually (trust-and-security)
- id: iso-27001
  conforms: true
  evidence: operates on ISO 27001 framework (trust-and-security)
- id: pci-dss
  conforms: false
  evidence: explicitly not PCI compliant; does not process card data directly