generated: '2026-08-02'
method: searched
source: >
  openapi/clear-street-trading-api-openapi.yml, openapi/clear-street-studio-openapi.yml,
  well-known/, https://www.clearstreet.io/legal/clear-street-trust-center,
  https://www.clearstreet.io/legal/security
standards:
- id: openapi-3.1
  conforms: true
  evidence: 'openapi/clear-street-trading-api-openapi.yml declares openapi: 3.1.0 with 45 paths / 61 operations'
- id: openapi-3.0
  conforms: true
  evidence: 'openapi/clear-street-studio-openapi.yml declares openapi: 3.0.0 with 26 paths / 32 operations'
- id: swagger-2.0
  conforms: true
  evidence: 'openapi/clear-street-legacy-api-swagger.yml declares swagger: "2.0" (legacy Trades/Uploads API)'
- id: oauth2
  conforms: true
  evidence: >
    Studio uses the RFC 6749 client-credentials grant against
    https://auth.clearstreet.io/oauth/token with audience https://api.clearstreet.io and scope
    `studio`; the MCP server uses authorization_code.
- id: oauth2-pkce
  conforms: true
  evidence: 'MCP authorization server advertises code_challenge_methods_supported: [S256] (RFC 7636)'
- id: oidc
  conforms: true
  evidence: 'https://auth.clearstreet.io/.well-known/openid-configuration returns a full OIDC
    discovery document (Auth0 tenant)'
- id: rfc8414-oauth-authorization-server-metadata
  conforms: true
  evidence: '/.well-known/oauth-authorization-server returns 200 on auth.clearstreet.io and on
    api.clearstreet.com/oauth/mcp'
- id: rfc9728-oauth-protected-resource-metadata
  conforms: true
  evidence: >
    An anonymous request to https://api.clearstreet.com/v1/mcp returns 401 with
    WWW-Authenticate: Bearer resource_metadata="…/.well-known/oauth-protected-resource/v1/mcp",
    and that document resolves 200.
- id: rfc9449-dpop
  conforms: partial
  evidence: 'The Auth0 tenant advertises dpop_signing_alg_values_supported, but no Clear Street
    API documentation requires or describes DPoP.'
- id: mcp
  conforms: true
  evidence: 'Official remote MCP server at https://api.clearstreet.com/v1/mcp (OAuth-gated);
    advertised on https://www.clearstreet.com/api'
- id: rfc9457-problem-details
  conforms: partial
  evidence: >
    The Studio OpenAPI defines a ProblemDetails schema with type/title/status/detail/instance on
    the shared `default` response, but serves it as application/json rather than
    application/problem+json. The Trading API does NOT use RFC 9457 — it returns a vendor
    ApiError envelope with code/message/details.
- id: rfc9116-security-txt
  conforms: false
  evidence: 'No /.well-known/security.txt on any probed host (404 across nine hosts).'
- id: rfc8594-sunset-header
  conforms: false
  evidence: 'No Sunset or Deprecation response headers are declared in either specification;
    deprecation is announced in a dated changelog only.'
- id: a2a
  conforms: false
  evidence: 'No agent card at /.well-known/agent-card.json or /.well-known/agent.json on any
    probed host.'
- id: asyncapi
  conforms: false
  evidence: >
    No AsyncAPI document is published. A real WebSocket event surface exists and is documented
    in prose — see asyncapi/clear-street-studio-events.yml.
- id: llms-txt
  conforms: true
  evidence: 'https://docs.clearstreet.com/llms.txt returns 200 (10.8 KB, full API index in
    llms.txt format)'
- id: json-api
  conforms: false
  evidence: 'Uses a bespoke data/error/metadata envelope, not JSON:API.'
- id: fix-4.2
  conforms: true
  evidence: >
    Clear Street publishes a FIX 4.2 trade specification
    (https://clear-street.github.io/FIX-docs/ and clear-street/docs/fix_trade_specification.md);
    connections accepted 5 AM–9 PM EST on business days.
- id: osi-option-symbology
  conforms: true
  evidence: 'InstrumentIdOrSymbol accepts an OSI option symbol; option search matches OSI prefixes.'
- id: fhir-r4
  conforms: false
- id: fapi
  conforms: false
  evidence: 'No FAPI profile is claimed; the API is not an open-banking surface.'
- id: scim
  conforms: false
- id: odata
  conforms: false
- id: psd2
  conforms: false
compliance:
  published: true
  certifications:
  - {name: SOC 2 Type II, scope: Prime Brokerage Platform, source: 'https://www.clearstreet.io/legal/clear-street-trust-center'}
  regulatory:
  - FINRA member broker-dealer
  - SIPC member
  - CFTC-registered Futures Commission Merchant
  - NFA member
  - FCA-authorised in the UK (Clear Street UK Limited)
  - London Metals Exchange Category 1 member
  brokercheck: https://brokercheck.finra.org/firm/summary/288933
  see: security/clear-street-trust-center.yml
x-evidence:
  fetched: '2026-08-02'
  note: >
    Standards are asserted only where a fetched document or a parsed spec field proves them.
    `conforms: false` records a verified absence, not an untested assumption.