generated: '2026-07-22'
method: derived
source: openapi/marketdata-app-openapi-original.yml + https://www.marketdata.app/docs/api/
standards:
  - id: oauth2
    conforms: false
    evidence: No OAuth2 flows; authentication is a static Bearer token generated in the customer dashboard.
  - id: oidc
    conforms: false
    evidence: /.well-known/openid-configuration returns 404 on both hosts.
  - id: http-bearer-auth
    conforms: true
    evidence: 'securitySchemes "Api Authentication" - Authorization: Bearer <token> (RFC 6750-style usage without OAuth issuance).'
  - id: rfc9457-problem-details
    conforms: false
    evidence: 'Errors use a custom JSON envelope {"s": "error", "errmsg": "..."}, not application/problem+json.'
  - id: pagination
    conforms: true
    evidence: Universal limit (default 10,000, max 50,000) and offset parameters documented for all endpoints.
  - id: rate-limit-headers
    conforms: true
    evidence: X-Api-Ratelimit-Limit / -Remaining / -Reset / -Consumed response headers documented.
  - id: idempotency-key
    conforms: false
    evidence: Read-only GET API; no Idempotency-Key contract documented.
  - id: cors
    conforms: true
    evidence: CORS behavior documented at https://www.marketdata.app/docs/api/cors/.
  - id: json-api
    conforms: false
    evidence: Responses use a compact columnar envelope (parallel arrays keyed by short field names), not JSON:API.
  - id: rfc9116-security-txt
    conforms: false
    evidence: /.well-known/security.txt returns 404 on both hosts.
  - id: rfc8594-sunset-header
    conforms: false
    evidence: No Sunset/Deprecation header support or deprecation policy published.
notes: >-
  No published compliance program or certifications (SOC 2 / ISO 27001 / etc.)
  were found - no trust center exists as of 2026-07-22, so no Compliance
  pointer is emitted.