generated: '2026-08-04' method: derived source: openapi/fundrise-connect-openapi.yml, well-known/fundrise-openid-configuration.json, well-known/fundrise-security.txt docs: https://connect.fundrise.com/ notes: >- Cross-cutting standards conformance for Fundrise, derived from the published OpenAPI 3.1.0, the anonymous /.well-known/ surface, and the documentation narrative. Absence of a claim is recorded as conforms:false with the reason, not left blank. standards: - id: openapi-3.1 conforms: true evidence: >- Published OpenAPI 3.1.0 document with 15 paths, 17 operations, 37 component schemas, tags on every operation, unique operationIds, and 2xx plus 4xx/5xx responses declared throughout. Distributed inside the Redocly documentation bundle at connect.fundrise.com. - id: rest conforms: true evidence: >- Self-declared and structurally consistent — resource-oriented URLs, JSON responses, conventional HTTP verbs and status codes. - id: http-basic-auth conforms: true evidence: securityScheme PartnerBasicAuthentication, type http, scheme basic (RFC 7617). - id: http-bearer-auth conforms: true evidence: securityScheme ClientBearerAuthentication, type http, scheme bearer (RFC 6750). - id: oauth2 conforms: partial evidence: >- Two distinct OAuth surfaces exist. (1) The consumer authorization server at fundrise.com publishes authorization_endpoint and token_endpoint and supports the authorization_code and refresh_token grants. (2) The Connect partner API implements a refresh_token grant at POST /v1/oauth/token returning an OAuth2AccessTokenResponse with accessToken, refreshToken, scope, tokenType and expiresIn. Marked partial because the OpenAPI models this as an http bearer scheme rather than an oauth2 securityScheme with declared flows, so generated clients get no flow metadata. - id: oidc conforms: partial evidence: >- https://fundrise.com/.well-known/openid-configuration returns 200 with scopes_supported [openid, offline_access], response_types_supported [code], and token_endpoint_auth_methods [client_secret_basic]. Marked partial because the document omits fields OpenID Connect Discovery 1.0 requires — issuer, jwks_uri, subject_types_supported, id_token_signing_alg_values_supported — so it is a partial discovery document rather than a conformant one. - id: rfc8414-oauth-authorization-server-metadata conforms: false evidence: /.well-known/oauth-authorization-server returned 403 on fundrise.com and 404 on connect.fundrise.com. - id: rfc9728-oauth-protected-resource-metadata conforms: false evidence: /.well-known/oauth-protected-resource returned 403 on fundrise.com and 404 on connect.fundrise.com. - id: rfc9116-security-txt conforms: true evidence: >- https://fundrise.com/.well-known/security.txt returns 200 with Contact, Encryption, Expires and Preferred-Languages fields. Expires is set to 2030-02-20, which exceeds the one-year maximum RFC 9116 recommends. - id: rfc9457-problem-details conforms: false evidence: >- Errors use a vendor envelope (FundriseConnectError with referenceId/code/message/ validationErrors) served as application/json. No application/problem+json media type and no type/title/status/detail/instance members appear anywhere in the spec. - id: idempotency-key-header conforms: false evidence: >- Idempotency is genuinely supported but not via the draft Idempotency-Key header. It is carried as a partnerReferenceId field in the request body of CreateClient and PlaceInvestment, with 409 signalling a duplicate. - id: rfc8594-sunset-header conforms: false evidence: >- A deprecation policy is documented in prose ("Partners will be given ample time to integrate with new versions according to our service agreement") but no Sunset or Deprecation response header is documented and no operation is marked deprecated. - id: pagination conforms: false evidence: >- No page/offset/cursor/limit parameters and no paging envelope on any collection operation. Collections return bare JSON arrays. - id: json-api conforms: false evidence: Plain JSON payloads; no JSON:API document structure, media type, or conventions. - id: hal conforms: false evidence: No hypermedia links in any response schema. - id: asyncapi conforms: false evidence: >- No event, streaming or webhook surface is published. The OpenAPI declares no webhooks block and no callbacks, and no AsyncAPI document was found on any Fundrise host. This is a genuine absence of an event surface, not an unharvested artifact. - id: mcp conforms: false evidence: No Model Context Protocol server is published or documented by Fundrise. - id: a2a conforms: false evidence: >- /.well-known/agent-card.json and /.well-known/agent.json probed on fundrise.com (403), connect.fundrise.com (404), api.fundrise.com (403) and sandbox.fundrise.com (no connection). No agent card is served. - id: graphql conforms: false evidence: No GraphQL endpoint documented or discovered. - id: tls-1.3 conforms: true evidence: fundrise.com negotiates TLSv1.3 (see security/fundrise-domain-security.yml). - id: dnssec conforms: true evidence: DNSSEC is enabled on the fundrise.com zone (probed 2026-08-04). - id: dmarc conforms: true evidence: DMARC record present with policy quarantine (probed 2026-08-04). - id: hsts conforms: false evidence: No Strict-Transport-Security header observed on fundrise.com. - id: caa conforms: false evidence: No CAA records published for fundrise.com. regulatory_context: note: >- Fundrise operates as an SEC-regulated sponsor of Regulation A+ offerings, and the contract encodes that regime — Clients must be presented with offering documents and acknowledgments and must digitally accept them before an investment or liquidation can be placed (acknowledgedDocumentIds is required on InvestmentPlacementRequest; allAcknowledgmentsAccepted is required on ShareLiquidationRequest). Tax reporting is exposed through GetTaxForms. This is regulatory posture visible in the API surface. published_certifications: none-found certification_probe: >- No trust center, SOC 2, ISO 27001, PCI DSS or comparable certification page was found on any Fundrise host. trust.fundrise.com did not resolve; fundrise.com/trust, /compliance and /security returned 404 under rendered fetch. Because no compliance program is published, no `Compliance` pointer is emitted in apis.yml. summary: conforms: 8 partial: 2 does_not_conform: 13 strongest: - openapi-3.1 - rfc9116-security-txt - http-bearer-auth weakest: - rfc9457-problem-details - pagination - rfc8594-sunset-header