generated: '2026-07-18'
method: derived
source: openapi/checkmate-openstock-openapi-original.json + https://openstock.sh
standards:
- id: openapi-3.1
  conforms: true
  evidence: openapi field is "3.1.0" and the document validates
- id: http-bearer-auth
  conforms: true
  evidence: prose-documented Authorization Bearer <api_key> on all authenticated endpoints
- id: oauth2
  conforms: false
  evidence: no oauth2 securitySchemes; partner-issued bearer API keys instead
- id: oidc
  conforms: false
- id: rfc9457-problem-details
  conforms: false
  evidence: 'errors use a custom { error: { code, message } } envelope, not application/problem+json'
- id: rfc9116-security-txt
  conforms: true
  evidence: https://joincheckmate.com/.well-known/security.txt (Contact, Policy, Expires, Preferred-Languages)
- id: idempotency
  conforms: true
  evidence: /v1/merchants/codes requires a per-query idempotency_key
- id: mcp
  conforms: true
  evidence: OpenStock publishes a native Model Context Protocol server at https://mcp.joincheckmate.com
- id: json-api
  conforms: false
- id: rest-pagination
  conforms: false
  evidence: batched-query shape, no cursor/offset pagination
compliance_program:
  published: false
  note: >-
    Checkmate publishes a responsible-disclosure / bug-bounty security page but
    does NOT publish named certifications (SOC 2, ISO 27001, PCI DSS, HIPAA,
    FedRAMP). No Compliance pointer is emitted.