How the Catalog Relates
The hand-authored relationships between standards across the whole catalog — which practices are realized by which standards, and which standards build on, profile or supersede each other. A weaker claim than the specification map, deliberately kept separate from it.
What this page claims, and what it does not
Every edge here is a curator's assertion with a note. No property backs it.
That is a weaker claim than the one made on
the specification map, where nine
published schemas are read side by side and every edge names the property that proves it —
go and look at sourceDescriptions, and the edge is there.
The two are different instruments pointed at different populations, and they share 0 edges — not one. Do not add the numbers together.
relationships
entries connected
practice → standard
standard → standard
A practice, and the standards that realize it
A practice is an argument about how to work; a standard is a way of actually doing it. These 24 edges are where the idea becomes an artifact someone can implement against.
API-First
| AsyncAPI | API-first for event-driven interfaces: the channels and messages agreed before anything publishes to them. |
| JSON Schema | The shapes the contract is written in, so the payloads are agreed as precisely as the operations. |
| OpenAPI | The contract written before the implementation — the artifact that makes API-first mean something a machine can check. |
BDD
| Gherkin | The Given/When/Then grammar BDD scenarios are written in, and the reason they are executable rather than prose. |
Event-driven Architecture
| AsyncAPI | Describes the channels, messages and participants an event-driven system is assembled from. |
| CloudEvents | A common envelope for events, so a consumer can read one without knowing which producer emitted it. |
| MQTT | A transport the pattern is frequently built on, particularly where the publishers are devices. |
Hypermedia
| Collection+JSON | A hypermedia type for collections, with templates describing how to add to them. |
| HAL | A minimal way to carry links in JSON, which is the whole of what hypermedia asks for. |
| JSON:API | A conventions layer that includes relationships and links as part of the document shape. |
| Siren | Carries actions as well as links, so a response describes what can be done next, not only what exists. |
OpenChain
| CycloneDX | An alternative SBOM format serving the same conformance need, common where security is the driver. |
| SPDX | The bill of materials an OpenChain-conformant program produces and exchanges. |
Schema Validation
| JSON Schema | The vocabulary most validation is actually expressed in. |
| Spectral | Lints the document itself against a ruleset, which is validation applied to the contract rather than the payload. |
Secure Software Development Lifecycle
| in-toto | Attests that each step of the supply chain was carried out by who was supposed to carry it out. |
| Sigstore | Signing and transparency for artifacts, so what was built can be shown to be what is deployed. |
| SLSA | A framework of levels for the integrity of the build, turning the practice into something assessable. |
Service Oriented Architecture
| SOAP | The messaging protocol most SOA implementations actually spoke. |
| WSDL | The interface contract SOA services were described with, and the basis for generated clients. |
Spec-Driven Development
| Kiro | AWS's agentic IDE, where the requirements/design/tasks trio that SDD converged on was popularized. |
| OpenSpec | A lightweight SDD convention: a change folder of proposal, design, tasks and requirement deltas. |
| Spec Kit | GitHub's SDD toolkit: a project constitution, then specify, plan, tasks, implement and converge. |
Versioning Protocols
| Semantic Versioning (SemVer) | The convention that gives a version number a meaning a consumer can depend on. |
Standards that build on each other
42 edges where one standard profiles, supersedes, extends or is commonly deployed beside another. Direction is as the curator wrote it, which is itself information: 5 of these pairs were written from both ends, and the rest point one way.
| From | To | How they relate |
|---|---|---|
| CARIN Blue Button | HL7 FHIR | CARIN Blue Button is a FHIR implementation guide for consumer-directed claims data. |
| CDS Hooks | HL7 FHIR | CDS Hooks cards reference and act on FHIR resources; the two standards are designed to compose. |
| CDS Hooks | SMART on FHIR | A CDS Hooks card can launch a SMART app to complete a decision, linking guidance to action. |
| Confirmation of Payee | UK Open Banking Standard | CoP is part of the UK's payments assurance layer alongside Open Banking payment initiation. |
| Confirmation of Payee | Variable Recurring Payments | Payee verification underpins safe account-to-account payments, including VRP. |
| Consolidated CDA | HL7 FHIR | Much clinical data still moves as C-CDA documents alongside or beneath FHIR APIs. |
| Consolidated CDA | HL7 v2 | C-CDA is the document-oriented HL7 standard that predates and complements FHIR's resource model. |
| CXL | PCI Express | The physical layer CXL builds cache-coherent memory semantics on top of. |
| Da Vinci | HL7 FHIR | Every Da Vinci implementation guide is a set of FHIR profiles and operations. |
| Da Vinci | US Core | Da Vinci IGs build on US Core as their base data layer. |
| Electronic Bill of Lading | DCSA | Publishes the container-shipping eBL standards the carriers implement. |
| FAPI | FAPI 2.0 Security Profile ↔ | The current generation, Final since 22 February 2025 — PAR, PKCE and mTLS or DPoP required. |
| FAPI 2.0 Security Profile | DPoP (Demonstrating Proof of Possession) | One of the two permitted ways to sender-constrain access tokens (RFC 9449). |
| FAPI 2.0 Security Profile | FAPI ↔ | The FAPI family page — FAPI 1.0 Baseline/Advanced and FAPI 2.0 together. |
| FAPI 2.0 Security Profile | Mutual TLS (mTLS) for OAuth | The other sender-constraining method, and one of two client authentication methods (RFC 8705). |
| FAPI 2.0 Security Profile | OAuth 2.0 Security Best Current Practice | FAPI 2.0 is built on the Security BCP (RFC 9700) plus a formal attacker model. |
| FAPI 2.0 Security Profile | OpenID Connect | FAPI 2.0 references OIDC Core and Discovery; ID tokens travel back-channel only. |
| FAPI 2.0 Security Profile | PKCE (Proof Key for Code Exchange) | Mandatory with the S256 challenge method; it replaces state-based CSRF protection. |
| FAPI 2.0 Security Profile | private_key_jwt | The other permitted client authentication method. |
| FAPI 2.0 Security Profile | Pushed Authorization Requests | Mandatory — the authorization server rejects any request not sent through PAR (RFC 9126). |
| FHIR Bulk Data Access | HL7 FHIR | Bulk Data is a FHIR operation ($export) for population-scale access to the same resources. |
| FHIR Bulk Data Access | US Core | Exports are typically constrained to US Core profiles for regulated data-sharing. |
| HITRUST CSF | ISO/IEC 27001 | HITRUST CSF harmonizes and maps to ISO 27001 among many other frameworks. |
| HITRUST CSF | SOC 2 ↔ | HITRUST and SOC 2 are the two attestations healthcare and SaaS buyers most often ask for together. |
| IEEE 2030.5 | OpenADR | The two demand-response protocols this market names together, at 7 companies each. |
| ISO/IEC 27001 | NIST | ISO 27001 controls map closely to NIST frameworks widely used in the US. |
| ISO/IEC 27001 | SOC 2 ↔ | ISO 27001 (a certifiable standard) and SOC 2 (an attestation report) are the two most-requested security assurances. |
| ISO/IEC 42001 | ISO/IEC 27001 | ISO 42001 extends the same management-system pattern from information security to AI. |
| MTConnect | OPC UA | Frequently deployed alongside MTConnect, with a published companion mapping between the two. |
| Peppol | UBL | The document schemas Peppol's BIS profiles constrain. |
| ROS | DDS | ROS 2 runs on DDS, which supplies the real-time pub/sub and QoS model underneath it. |
| SMART on FHIR | HL7 FHIR | SMART is the authorization layer that makes FHIR safely usable by third-party and patient-facing apps. |
| SMART on FHIR | OAuth | SMART is a profile of OAuth 2.0 + OpenID Connect specialized for health-data scopes. |
| SMART on FHIR | US Core ↔ | The data profiles a SMART app reads once granted FHIR scopes. |
| SOC 2 | HITRUST CSF ↔ | In healthcare, SOC 2 and HITRUST are frequently held together. |
| SOC 2 | ISO/IEC 27001 ↔ | SOC 2 (an attestation report) and ISO 27001 (a certification) are the two most-requested security assurances. |
| Thread | Matter | The application layer that runs over Thread. |
| US Core | HL7 FHIR | US Core is the US-realm implementation guide that constrains base FHIR into required profiles. |
| US Core | SMART on FHIR ↔ | US Core defines the resources; SMART defines authorized access to them. |
| US Core | USCDI ↔ | US Core is the FHIR representation of the data elements USCDI mandates. |
| USCDI | HL7 FHIR | USCDI defines the data; FHIR + US Core define how it is exchanged. |
| USCDI | US Core ↔ | US Core is the FHIR implementation guide that operationalizes USCDI's data elements. |
Sources and method
Hand-authored relations harvested from the _store entries themselves — the `realized_by` key a practice carries, and the `standards` key an entry carries. Each edge is a curator's assertion with a note, and no property backs it. This is deliberately a weaker claim than /relationships/, which reads nine published schemas and names the property proving every edge. The two graphs share no edge at all and must never be summed. Harvested from the entries by scripts/build-catalog-edges.py, last run
2026-09-19. The practice edges are written in both directions by
PLANNING/wire-philosophy-edges.py from a single curated list, and counted once here.
An edge whose far end is not an entry in this catalog is dropped rather than shipped as a dead link.