Standards Fundamentals

Welcome. This hub explains the identity and API security standards we build on. Each primer is vendor‑agnostic, fast to read, and links to deeper, technical docs in our services.

Use this to get clarity, align teams, and make confident decisions.

Browse by category

Identity & Access

• What is OAuth 2.0
• What is OpenID Connect (OIDC)
• What is PKCE

Fine‑grained authorization

• What is RAR (Rich Authorization Requests)

Security profiles & authorization flows

• What is PAR (Pushed Authorization Requests)
• What is JARM (JWT Secured Authorization Response Mode)
• What is FAPI 2.0

Provisioning & Directory

• What is SCIM

Agent workflows & eventing

• What is CIBA
• What is MCP (Model Context Protocol)
• What is CAEP (Continuous Access Evaluation Protocol)

How to use these primers

• Start with the short definition and why‑it‑matters.
• Skim the “How it works” flow and common pitfalls.
• Follow “Next steps” to our service docs for implementation.

Note: Technical configuration tables and flags live in service reference pages (single source of truth). These primers stay educational and timeless.