generated: '2026-07-22'
method: searched
source: https://id.livevol.com/.well-known/openid-configuration
description: >-
  Industry and cross-cutting standards conformance for Cboe's public API
  surface (LiveVol All Access API + LiveVol IdentityServer), based on the
  published OIDC discovery document and the API documentation. No OpenAPI or
  other machine-readable API contract is published, so spec-derived checks are
  limited to what the docs state.
standards:
  - id: oauth2
    conforms: true
    evidence: >-
      id.livevol.com IdentityServer supports authorization_code,
      client_credentials, password, refresh_token, and implicit grants
      (openid-configuration grant_types_supported); documented at
      https://api.livevol.com/v1/docs/Home/Authentication.
  - id: oidc
    conforms: true
    evidence: >-
      OpenID Connect discovery document published at
      https://id.livevol.com/.well-known/openid-configuration with openid
      scope, JWKS, userinfo and end-session endpoints.
  - id: rfc6750-bearer-tokens
    conforms: true
    evidence: 'Access tokens sent as "Authorization: Bearer <token>" per the authentication docs.'
  - id: rfc8414-oauth-metadata
    conforms: false
    evidence: /.well-known/oauth-authorization-server returns 404 on id.livevol.com and api.livevol.com.
  - id: rfc9116-security-txt
    conforms: false
    evidence: No /.well-known/security.txt found (404 on datashop/api.livevol hosts; 403 WAF on www.cboe.com).
  - id: rfc9457-problem-details
    conforms: false
    evidence: >-
      Error responses are documented as plain HTTP status codes with an error
      message (https://api.livevol.com/v1/docs/Home/ResponseCodes); no
      application/problem+json.
  - id: rate-limiting-429
    conforms: true
    evidence: >-
      429 Too Many Requests documented for both request-frequency limits and
      monthly/daily points-allowance exhaustion
      (https://api.livevol.com/v1/docs/Home/ResponseCodes).
  - id: openapi
    conforms: false
    evidence: >-
      No OpenAPI/Swagger document found: probed api.livevol.com and
      datashop.cboe.com /openapi.json, /swagger.json, /v1/swagger.json,
      /swagger/v1/swagger.json, /v1/docs/swagger.json — all 404. Docs are an
      auto-generated ASP.NET Web API help site.