generated: '2026-07-17'
method: derived
source: >-
  openapi/fazz-openapi.yml ; https://docs.fazz.com/docs/handling-errors ;
  https://docs.fazz.com/docs/pagination-sorting-filtering
summary: >-
  Cross-cutting standards conformance, derived from the OpenAPI and the live
  docs. Fazz uses HTTP Basic auth (no OAuth/OIDC), custom error codes (not RFC
  9457), and page-based pagination.
standards:
- id: oauth2
  conforms: false
  evidence: securityScheme is http/basic; no oauth2 flows.
- id: oidc
  conforms: false
- id: rfc9457-problem-details
  conforms: false
  evidence: Errors use custom code envelope, not application/problem+json.
- id: http-basic-auth
  conforms: true
  evidence: securitySchemes.basicAuth type http scheme basic.
- id: pagination
  conforms: true
  evidence: page[size]/page[number] + sort + filter[] documented.
- id: idempotency
  conforms: true
  evidence: POST requests accept a referenceId idempotency key (docs/idempotent-requests).
- id: webhook-signing-hmac
  conforms: true
  evidence: Callbacks signed HMAC-SHA256 via X-Xfers-Signature header.
- id: fhir-r4
  conforms: false
- id: fapi
  conforms: false
- id: scim
  conforms: false
- id: odata
  conforms: false
- id: psd2
  conforms: false
- id: json-api
  conforms: false
  evidence: filter[]/page[] syntax resembles JSON:API but responses are not JSON:API documents.
regulatory:
  note: >-
    Fazz Business Singapore operates via Xfers Pte. Ltd. under Singapore's
    Payment Services Act (MAS); Indonesia operations under Bank Indonesia / OJK.
    No enumerated security certifications (SOC 2 / ISO 27001 / PCI DSS) were
    found published. See security/fazz-trust-center.yml.