generated: '2026-07-18'
method: derived
source: openapi/brale-openapi-original.yml
standards:
- id: oauth2
  conforms: true
  evidence: OpenAPI securityScheme type oauth2, clientCredentials flow, tokenUrl https://auth.brale.xyz/oauth2/token
- id: oidc
  conforms: false
  evidence: auth.brale.xyz serves /.well-known/openid-configuration but with a placeholder localhost issuer; only client-credentials is used
- id: json-api-errors
  conforms: true
  evidence: error responses use JSON:API error objects (Failure -> errors[] with code/status/title/detail/source.pointer/source.parameter/links/meta)
- id: rfc9457-problem-details
  conforms: false
  evidence: errors follow JSON:API, not application/problem+json
- id: rfc9116-security-txt
  conforms: true
  evidence: https://brale.xyz/.well-known/security.txt present with Contact + Policy + Expires
- id: pagination
  conforms: true
  evidence: list operations expose a page query parameter
- id: idempotency
  conforms: true
  evidence: Idempotency-Key header documented and present in the OpenAPI
- id: webhooks
  conforms: true
  evidence: webhook subscription, delivery, event-type, and event-resend operations
- id: fhir-r4
  conforms: false
- id: fapi
  conforms: false
- id: scim
  conforms: false
- id: psd2
  conforms: false
compliance_note: >-
  Brale describes itself as a regulated stablecoin issuer with reserves held in
  segregated accounts (cash, money market funds, Treasury bills). No specific named
  third-party security certification (SOC 2 / ISO 27001 / PCI DSS) was found published
  on a public trust page during this pass, so no Compliance pointer is emitted.