generated: '2026-07-19'
method: derived
source: openapi/lighter-zklighter-openapi-original.json
standards:
  - id: openapi-3.0
    conforms: true
    evidence: >-
      Lighter publishes an OpenAPI 3.0.0 document with 78 operations and 142 component schemas in
      the lighter-python SDK repository (openapi.json).
  - id: oauth2
    conforms: false
    evidence: securitySchemes declare only an apiKey scheme; no oauth2 flows are defined or documented
  - id: oidc
    conforms: false
  - id: rfc9457-problem-details
    conforms: false
    evidence: >-
      Errors are returned as a numeric business code plus message, not application/problem+json.
      See errors/lighter-error-codes.yml.
  - id: rfc9116-security-txt
    conforms: false
    evidence: no /.well-known/security.txt served; disclosure policy published as a docs page instead
  - id: rfc8594-sunset-header
    conforms: false
    evidence: no Sunset or Deprecation header support documented
  - id: idempotency
    conforms: true
    evidence: >-
      Per-API-key monotonic nonces plus a client-supplied client_order_index that is unique across
      markets, both enforced server-side (errors 21104, 21105, 21728). No Idempotency-Key header.
      See conventions/lighter-conventions.yml.
  - id: pagination
    conforms: true
    evidence: index/limit/cursor parameters on list operations, defined per operation rather than globally
  - id: asyncapi
    conforms: false
    evidence: >-
      Lighter documents a WebSocket streaming surface but publishes no AsyncAPI document; this repo
      carries a generated one at asyncapi/lighter-zklighter-asyncapi.yml.
  - id: json-api
    conforms: false
  - id: odata
    conforms: false
  - id: scim
    conforms: false
  - id: fapi
    conforms: false
  - id: psd2
    conforms: false
  - id: fhir-r4
    conforms: false
compliance_program:
  published: false
  note: >-
    Lighter publishes third-party smart contract and zk circuit audit reports
    (https://docs.lighter.xyz/security/security-audits) but no named enterprise compliance
    certifications (SOC 2, ISO 27001, PCI DSS, HIPAA, FedRAMP). No Compliance or TrustCenter
    pointer is emitted, and no trust-center artifact is produced.