generated: '2026-07-19'
method: derived
source: openapi/korbit-openapi.yml, https://docs.korbit.co.kr/llms-full.txt
description: >-
  Cross-cutting standards conformance for the Korbit Open API v2, derived from the generated OpenAPI
  and Korbit's published reference. Korbit publishes no certification or compliance program of its
  own (no trust center, no SOC 2 / ISO 27001 claims were found), so no Compliance pointer is emitted.
standards:
- id: oauth2
  conforms: false
  evidence: >-
    No oauth2 security scheme. Authentication is an API key (X-KAPI-KEY) plus a per-request
    signature.
- id: oidc
  conforms: false
  evidence: No OpenID Connect discovery document or openIdConnect security scheme.
- id: rfc9457-problem-details
  conforms: false
  evidence: >-
    Errors use a proprietary envelope, {"success": false, "error": {"message": "<CODE>"}}, with
    application/json rather than application/problem+json.
- id: rfc6750-bearer-token
  conforms: false
  evidence: No bearer token; the API key travels in the X-KAPI-KEY header.
- id: rfc9116-security-txt
  conforms: false
  evidence: No /.well-known/security.txt published — see well-known/korbit-well-known.yml.
- id: rfc8594-sunset-header
  conforms: false
  evidence: No Sunset or Deprecation headers documented — see lifecycle/korbit-lifecycle.yml.
- id: ietf-ratelimit-headers
  conforms: true
  partial: true
  evidence: >-
    Publishes RateLimit-style headers — "Ratelimit: limit=50, remaining=48, reset=1" and
    "Ratelimit-Policy: 50;w=1" — aligned with the IETF RateLimit header fields draft, plus
    Retry-After on HTTP 429.
- id: idempotency
  conforms: true
  partial: true
  evidence: >-
    Order placement is idempotent via a client-supplied clientOrderId processed exactly once
    server-side. This is a request-parameter idempotency key rather than the IETF Idempotency-Key
    header draft.
- id: pagination
  conforms: false
  evidence: >-
    No cursor or offset pagination. History endpoints are bounded by fixed server-side time windows
    (36 hours) instead.
- id: json-api
  conforms: false
  evidence: Proprietary {success, data} envelope, not JSON:API media types or structure.
- id: odata
  conforms: false
- id: fhir-r4
  conforms: false
- id: scim2
  conforms: false
- id: fapi
  conforms: false
  evidence: >-
    No FAPI security profile. Note the API is financial but not an open-banking interface — it is an
    exchange trading API with API-key plus request-signature authentication.
- id: psd2
  conforms: false
  evidence: Not an EU payment-services interface; Korbit is a South Korean virtual-asset exchange.
- id: openapi
  conforms: false
  evidence: >-
    Korbit publishes no OpenAPI document. The OpenAPI 3.1 in this repo was generated by the API
    Evangelist pipeline from Korbit's published reference and is not an official Korbit artifact.
- id: asyncapi
  conforms: false
  evidence: >-
    Korbit publishes no AsyncAPI document. The AsyncAPI 3.0 in this repo was generated from the
    published WebSocket reference and is not an official Korbit artifact.
- id: llmstxt
  conforms: true
  evidence: >-
    Publishes a content-verified llms.txt at https://docs.korbit.co.kr/llms.txt plus a single-file
    llms-full.txt bundle, both purpose-written for AI coding agents.
- id: model-context-protocol
  conforms: true
  evidence: >-
    Ships an official MCP server bundled in korbit-cli (`korbit mcp serve`), exposing the API as MCP
    tools — see mcp/korbit-mcp.yml.
- id: agent-skills
  conforms: true
  evidence: >-
    Ships a first-party Agent Skill installable for Claude or Codex via `korbit agent skill install`.
- id: hmac-request-signing
  conforms: true
  evidence: HMAC-SHA256 request signing over the exact encoded request string, with a timestamp window.
- id: ed25519-request-signing
  conforms: true
  evidence: >-
    ED25519 signing supported as an alternative, with the user generating the key pair and
    registering only the public key.
- id: websocket-rfc6455
  conforms: true
  evidence: >-
    Public and private WebSocket endpoints at wss://ws-api.korbit.co.kr/v2/{public,private} with a
    documented subscribe/unsubscribe control protocol.
compliance_program:
  published: false
  certifications: []
  trust_center: null
  note: >-
    No trust center, compliance page or named certification (SOC 2, ISO 27001, PCI DSS, ISMS-P) was
    found on Korbit's public surface. Korbit is a registered South Korean virtual-asset service
    provider, but no public compliance artifact was located to cite, so nothing is asserted here.
related:
  security: security/korbit-domain-security.yml
  well_known: well-known/korbit-well-known.yml