generated: '2026-08-25' method: derived source: >- Derived from https://api.merqube.com/api (OpenAPI 3.1, info.version 4.40.0) and https://api.merqube.com/api-raw, cross-checked against https://merqube.stoplight.io/docs/api/p6s6m4p35ehfv-authentication and https://merqube.com/governance. Every `conforms: true` below points at an exact location in the contract; nothing is asserted from marketing prose. provider: MerQube api: MerQube API cross_cutting: - id: openapi conforms: true version: 3.1.0 evidence: >- openapi "3.1.0" at the root of https://api.merqube.com/api, 53 paths / 76 operations / 252 component schemas. Served unauthenticated from the API host itself and named as the canonical spec in MerQube's own SDK Overview. - id: json-schema conforms: true version: 2020-12 evidence: >- OpenAPI 3.1 dialect; components.schemas uses 2020-12 constructs throughout (anyOf/oneOf/allOf, pattern, prefix-free $ref). MerQube generates its pydantic client types directly from this document via bin/generate_types.sh. - id: rest conforms: true evidence: >- Resource-oriented paths with the full standard verb set (GET/POST/PUT/PATCH/DELETE) across /index, /identifier, /security, /security_list, /target_portfolio_handler. - id: oauth2 conforms: false evidence: >- No oauth2 securityScheme in the contract and no OAuth flow in the docs. Authentication is an API key in an Authorization header with an "APIKEY " prefix. (The index manifest does mention OAuth token emails in administrative.client fields, but that refers to MerQube's own internal console identity, not to an API authorization flow available to callers.) - id: oidc conforms: false evidence: /.well-known/openid-configuration returns 404 on api.merqube.com. - id: rfc9457 conforms: false evidence: >- No application/problem+json anywhere. 4xx responses declare a description string and no body schema or media type at all. See errors/merqube-problem-types.yml. - id: rfc8594-deprecation conforms: false evidence: >- No Deprecation or Sunset response header observed and none declared. There IS an in-band `deprecation_warnings` array in the response envelope, but it is undocumented and not the RFC mechanism. - id: idempotency conforms: false evidence: >- No Idempotency-Key header. MerQube instead ships optimistic concurrency (a `status` compare-and-set block required on PUT/PATCH) and 409-on-duplicate-name for creates. See conventions/merqube-conventions.yml. - id: pagination conforms: true style: page-number evidence: >- components.parameters.pageParam (default 1, minimum 1) and pageSizeParam (default 1000, minimum 1). No next-link or total-count field in the response envelope. - id: cors conforms: partial evidence: >- Live responses from api.merqube.com carry access-control-allow-origin https://internal.api.merqube.com - a single origin, and MerQube's own internal one. Browser callers from any other origin are not permitted. - id: rate-limit-headers conforms: false evidence: No RateLimit-*, X-RateLimit-* or Retry-After header on any observed response. - id: scim conforms: false evidence: No SCIM schema URN and no user-provisioning surface in the contract. - id: odata conforms: false evidence: No $metadata endpoint and no OData query options. - id: json-api conforms: false evidence: >- Custom envelope ({results, error_codes, deprecation_warnings, linked_resources}), not application/vnd.api+json. domain_standards: - id: iso-10383-mic name: ISO 10383 Market Identifier Codes conforms: true evidence: >- The contract types market venues as MIC codes, not as free text. components.schemas has a `mic` property with pattern "[A-Z0-9]{4}" titled "Mic Code" (examples XNYS, XCME); holiday calendars are addressed by an identifier grammar "^(FUT|MIC|FX|SM|MQI|OVERLAY):.+$" with cal_type "MIC"; and an exchange filter object is typed {type: enum[mic], mics: [string]}. A counterparty that already speaks MIC needs no venue mapping table. location: components.schemas (mic, calendar_identifiers, NestedCalendarSchema, exchange filters) - id: iso-3166-1-alpha-2 name: ISO 3166-1 alpha-2 country codes conforms: true evidence: >- components.schemas.CountryCode is described as "ISO country codes" and enumerates two-letter alpha-2 values (AE, AR, AT ... US, ZA) used on the options availability path /options/availability_dates/{fysm_id}/{country_code}. location: components.schemas.CountryCode defect: >- The enum contains a JSON `false` where "NO" (Norway) should be - the source YAML was written unquoted and YAML 1.1 coerced NO to a boolean. It is present in both the resolved JSON at /api and the raw YAML at /api-raw, so Norway is currently unrepresentable in this enum and any generated client will emit a boolean member. Quoting "NO" in the source fixes it. - id: iso-8601 name: ISO 8601 date and date-time conforms: true evidence: >- components.schemas.MerqTimestamp accepts format date-time, format date, and an explicit "^[0-9]{4}-[0-9]{2}-[0-9]{2}(?:[ T][0-9]{2}:[0-9]{2}:[0-9]{2})?(?:[.][0-9]{1,6})?$" pattern; IsoTS and IsoDate schemas are named for the standard. location: components.schemas.MerqTimestamp / IsoTS / IsoDate - id: iso-4217 name: ISO 4217 currency codes conforms: partial evidence: >- The index manifest carries a `currency` property but types it as a bare string with no enum and no pattern, so the standard is used by convention (live data shows EUR, USD) rather than enforced by the contract. location: components.schemas.IndexDefinitionPost.currency - id: fix-protocol conforms: false evidence: >- No FIX tags, sessions or message types. MerQube is an index calculation and administration surface, not an order-routing one; FIX is listed on the securities_market_data regime but is not applicable to this product. - id: iso-20022 conforms: false evidence: No ISO 20022 message types or namespaces anywhere in the contract. - id: mifid-ii conforms: unknown evidence: >- No MiFID II claim is made in any machine-readable artifact or in the API docs. MerQube does run a formal benchmark-governance process - published announcements, methodology consultations and policies at https://merqube.com/governance - which is the operational shape a regulated benchmark administrator maintains, but no authorisation, registration number or regime is asserted on a page this pipeline could read, so nothing is claimed here. vendor_identifier_schemes: note: >- Not open standards, recorded because they are the integration surface a buyer actually meets. schemes: - id: fsym name: FactSet FSYM permanent identifier evidence: fsym_id path/property used across options and equity-basket positions. - id: ric name: Refinitiv/Reuters Instrument Code evidence: components.schemas.RicSpecific / RicEquityPosition. - id: merqube-mqi name: MerQube index reference (MQI:) evidence: benchmark.ticker accepts "MQI:XXX" to benchmark one index against another. providers_supported: - bloomberg - reuters - morningstar - factset - nasdaq - wind - secapi compliance_published: false compliance_note: >- MerQube publishes no certification list, trust center or attestation page - no SOC 2, ISO 27001 or equivalent claim was found on merqube.com, on the Stoplight portal, or via a /.well-known probe. No `type: Compliance` pointer is emitted for that reason.