generated: '2026-08-06'
method: derived
source: openapi/ajaib-coin-exchange-openapi.yml
docs: https://ajaib.gitbook.io/coin-exchange
standards:
- id: oauth2
  conforms: false
  evidence: >-
    No oauth2 securityScheme. Authentication is an issued API key plus an
    ECDSASHA256 request signature.
- id: oidc
  conforms: false
  evidence: No openIdConnect securityScheme and no /.well-known/openid-configuration (404).
- id: rfc9457-problem-details
  conforms: false
  evidence: >-
    Errors are returned as a flat {"error": "<enum>"} JSON object with
    application/json, not application/problem+json.
- id: rfc9116-security-txt
  conforms: false
  evidence: >-
    /.well-known/security.txt returns 404 on every Ajaib host, though the
    equivalent contact is served in x-security-bugs-report headers.
- id: rfc8594-sunset-header
  conforms: false
  evidence: No Sunset or Deprecation header support documented.
- id: rfc9421-http-message-signatures
  conforms: false
  evidence: >-
    Requests are signed, but with a proprietary scheme (X-SIGNATURE over
    timestamp+method+path+query+body, ECDSASHA256), not the RFC 9421
    Signature/Signature-Input construction.
- id: hsts
  conforms: true
  evidence: >-
    strict-transport-security: max-age=31536000 observed on ajaib.co.id,
    kripto.ajaib.co.id and api.ajaib.co.id.
- id: json-api
  conforms: false
  evidence: Bare JSON objects and arrays; no JSON:API document structure.
- id: openapi
  conforms: false
  evidence: >-
    Ajaib publishes no OpenAPI document. The spec in openapi/ was written by API
    Evangelist from Ajaib's published reference.
- id: asyncapi
  conforms: false
  evidence: >-
    A websocket base endpoint (wss://stream.ajaib.co.id:443) is advertised but
    no channels or message schemas are published.
- id: cursor-pagination
  conforms: true
  evidence: >-
    getTrades and getOpenOrders take from_trade_id / from_order_id cursors with
    a limit parameter.
- id: idempotency
  conforms: false
  evidence: >-
    HTTP 409 is described as possibly caused by "the same idempotent key", but
    no idempotency key header or parameter is documented on any operation.
regulatory:
- id: ojk
  authority: Otoritas Jasa Keuangan (Indonesian Financial Services Authority)
  claim: >-
    Ajaib states it is registered and supervised by OJK, and lists its address
    at the Indonesia Stock Exchange building, Jakarta.
  verified: false
  note: >-
    The claim was read from third-party indexes of Ajaib's own legal pages; the
    ajaib.co.id legal page itself returns 403 to an unattended client, so this
    is recorded as an unverified provider claim, not a confirmed certification.
certifications: []
note: >-
  No SOC 2, ISO 27001, PCI DSS or other named certification is published on any
  reachable Ajaib surface, and no trust centre was found, so no Compliance
  pointer is emitted.