generated: '2026-07-19'
method: derived
source: openapi/groww-trade-api-openapi.yml + https://api.groww.in/.well-known/oauth-authorization-server
description: >-
  Cross-cutting standards conformance for the Groww Trading API, derived from
  the OpenAPI security schemes, the advertised OAuth authorization-server
  metadata, and the documented conventions. No published compliance-certification
  program (SOC 2 / ISO 27001 / PCI) was found for the trading API, so no
  Compliance pointer is emitted.
standards:
  - id: oauth2
    conforms: true
    evidence: >-
      OpenAPI declares an oauth2 authorization_code scheme; api.groww.in serves
      RFC 8414 OAuth 2.0 Authorization Server Metadata.
  - id: rfc8414-oauth-authorization-server-metadata
    conforms: true
    evidence: /.well-known/oauth-authorization-server returns 200 with issuer/endpoints/PKCE.
  - id: oauth2-pkce
    conforms: true
    evidence: code_challenge_methods_supported = [plain, S256]
  - id: rfc7591-dynamic-client-registration
    conforms: true
    evidence: registration_endpoint https://api.groww.in/oauth2/v1/register advertised.
  - id: bearer-token-auth
    conforms: true
    evidence: 'Authorization: Bearer {ACCESS_TOKEN} on all requests.'
  - id: rfc9457-problem-details
    conforms: false
    evidence: Errors use a custom { status, payload, error } envelope, not application/problem+json.
  - id: openid-connect
    conforms: false
    evidence: /.well-known/openid-configuration returns 404.
  - id: fapi
    conforms: false