generated: '2026-07-20'
method: derived
source: openapi/loopay-openapi-original.json
standards:
  - id: openapi-3.0
    conforms: true
    evidence: openapi 3.0.0 document published at https://api.loopay.com/openapi.json
  - id: rest
    conforms: true
    evidence: resource-oriented HTTP endpoints (payouts, payment-sources, companies, movements)
  - id: oauth2
    conforms: false
    evidence: token-based auth via POST /login; no oauth2 securityScheme declared
  - id: oidc
    conforms: false
  - id: rfc9457-problem-details
    conforms: false
    evidence: no application/problem+json responses; only 200/202 documented
  - id: pagination
    conforms: true
    evidence: page + recordsPerPage query parameters on listing endpoints
  - id: idempotency
    conforms: false
    evidence: no idempotency-key contract documented
  - id: webhooks
    conforms: false
    evidence: no webhook/event surface documented
note: >-
  DERIVED from the OpenAPI structure and conventions. No published compliance
  certifications (SOC 2 / ISO 27001 / PCI DSS) were found on the site, so NO
  Compliance pointer is emitted.