generated: '2026-07-19'
method: derived
source: openapi/greenspark-openapi.yml
description: >-
  Cross-cutting standards conformance for the Greenspark Climate API, derived
  from the reconstructed OpenAPI and the docs. Greenspark authenticates with an
  API key (no OAuth2/OIDC), returns plain JSON errors (not RFC 9457), and exposes
  carbon-estimation inputs keyed to Merchant Category Codes (ISO 18245) and Open
  Banking transaction category types. No published security/compliance
  certification program (SOC 2, ISO 27001, PCI, etc.) was found at probe time, so
  no Compliance pointer is asserted.
standards:
  - id: openapi-3.0
    conforms: true
    evidence: Provider publishes per-endpoint OpenAPI 3.0.0 definitions on docs.getgreenspark.com.
  - id: apikey-auth
    conforms: true
    evidence: securityScheme type apiKey in header (x-api-key).
  - id: oauth2
    conforms: false
  - id: oidc
    conforms: false
  - id: rfc9457-problem-details
    conforms: false
    evidence: Errors returned as application/json, not application/problem+json.
  - id: cursor-pagination
    conforms: true
    evidence: fetchRawReportV2 (GET /v2/reports) uses a cursor query parameter.
  - id: iso18245-mcc
    conforms: true
    evidence: Carbon estimation endpoints accept Merchant Category Codes (fetchCarbonEstimateOfATransactionByMcc).
  - id: open-banking-categories
    conforms: true
    evidence: Carbon estimation endpoints accept Open Banking category types.