generated: '2026-07-20'
method: derived
source: openapi/nestcoin-external-gateway-openapi-original.json
standards:
- id: openapi-3.0
  conforms: true
  evidence: openapi 3.0.3 document published at docs.onboard.xyz/api-reference/openapi.json (external gateway)
- id: oauth2
  conforms: false
  evidence: no oauth2 securityScheme; access-token flow is a custom x-api-key/x-auth-token model
- id: oidc
  conforms: false
- id: rfc9457-problem-details
  conforms: false
  evidence: errors returned as application/json, not application/problem+json
- id: hmac-request-signing
  conforms: true
  evidence: sensitive operations require HMAC-SHA256 x-signature over x-timestamp + body (30s window)
- id: webhooks-hmac
  conforms: true
  evidence: order.state_transition webhooks signed with HMAC-SHA256 via x-signature + x-timestamp headers
- id: pagination
  conforms: true
  evidence: list operations accept page + size query parameters
- id: idempotency
  conforms: false
  evidence: no Idempotency-Key parameter documented in the OpenAPI or docs
- id: fapi
  conforms: false