nedmcclain
It should not provide generalised database query functionality. YES - it only proivdes the subset of LDAP functionality necessary for authentication.
Its API should have password salting and hashing built in. NO - hashed but needs salting&scrypt.
Its API should throttle access with some sort of algorithm designed to prevent downloads of large quantities of user data. NO - todo.
It should encrypt data internally. YES (hashed not encrypted).
It should communicate only over encrypted connections. YES.
It should be distributed. YES.
It should not be run on any web server, should run "behind the scenes" and be accessible only via its API. YES.
It should include triggers and alerts based on uncommon access patterns or recognised nefarious access patterns. NO - todo.
It should have no other purpose. YES.