generated: '2026-08-26'
method: derived
source: >-
  openapi/northmill-flo-api-swagger.json; the Northmill Bank TPP documentation at
  developer.token.io/northmill_rest_api_doc/; https://www.northmill.com/se-en/about-us/security/;
  https://www.northmill.com/se-en/about-us/corporate-governance/;
  https://www.northmill.com/.well-known/security.txt.
description: >-
  Cross-cutting and domain standards, asserted only where the contract or the
  provider's own published pages carry the evidence. Northmill Bank is a licensed
  Swedish credit institution under Finansinspektionen supervision, which brings PSD2
  obligations; the Flo commerce API is a conventional Basic-auth REST API that
  implements none of the API-layer standards below.
standards:
  - id: oauth2
    conforms: false
    evidence: >-
      Flo API securityDefinitions declares only `basic` (HTTP Basic). No oauth2 flow,
      no token endpoint, no scopes anywhere in the contract.
  - id: oidc
    conforms: false
    evidence: /.well-known/openid-configuration returns 404 on both www.northmill.com and api.moreflo.com.
  - id: rfc9116-security-txt
    conforms: true
    evidence: >-
      PGP-signed security.txt served at https://www.northmill.com/.well-known/security.txt
      with Canonical, Contact, Encryption, Policy, Preferred-Languages, Hiring and a
      2027-07-15 Expires. Saved verbatim at well-known/northmill-security.txt.
  - id: rfc9457-problem-details
    conforms: false
    evidence: No application/problem+json anywhere; no 4xx/5xx response is documented at all.
  - id: rfc8594-sunset
    conforms: false
    evidence: No Sunset or Deprecation header is declared or documented.
  - id: idempotency
    conforms: partial
    evidence: >-
      No Idempotency-Key header. Deduplication is a body-level `UpdateOnExisting` upsert
      flag keyed on client-supplied natural keys (ExternalReference, ArticleNumber,
      CustomerNumber). See conventions/northmill-conventions.yml.
  - id: pagination
    conforms: true
    evidence: >-
      Page-number pagination on 49 paths - `page` and `pageSize` query parameters;
      responses carry list/Page/Total/PageSize. Note Total is documented as the number
      of PAGES, not items.
  - id: json-api
    conforms: false
    evidence: Plain JSON envelopes; no JSON:API media type, links or included members.
  - id: odata
    conforms: false
    evidence: No $metadata surface, no OData query options.
  - id: scim
    conforms: false
    evidence: No urn:ietf:params:scim:schemas URN; cashier users are a bespoke model.
  - id: fhir
    conforms: false
  - id: openapi-3
    conforms: false
    evidence: >-
      The published contract is Swagger 2.0 (`swagger: "2.0"`), not OpenAPI 3.x -
      generated by Swashbuckle from an ASP.NET service.
  - id: webhooks
    conforms: true
    evidence: >-
      A first-class webhook subscription API (/v2/webhooks, /v2/webhookcategories) with
      category-based event routing. See asyncapi/northmill-flo-webhooks.yml.
  - id: asyncapi
    conforms: false
    evidence: >-
      Webhooks are managed through REST but no AsyncAPI document is published and no
      event payload schema is published except the ReceiptCreated example embedded in
      the WebHookCategory description.
  - id: psd2
    conforms: true
    evidence: >-
      Northmill Bank AB (org.nr 556709-4866) holds a Swedish banking licence and is
      supervised by Finansinspektionen, and publishes a TPP-facing PSD2 interface
      covering AIS and CBPII/CAF with eIDAS-style request signing, at
      https://developer.token.io/northmill_rest_api_doc/. The RTS four-times-a-day
      TPP-initiated access rule is documented in its request-headers reference.
  - id: berlin-group-nextgenpsd2
    conforms: false
    evidence: >-
      The TPP interface is Token.io's proprietary REST/token-request model
      (POST /token-requests, GET /banks, member IDs and aliases), not the Berlin Group
      NextGenPSD2 XS2A shape. No /v1/consents or /v1/accounts Berlin Group paths.
  - id: fapi
    conforms: false
    evidence: No FAPI profile is claimed and no FAPI-specific security scheme appears in either surface.
  - id: pci-dss
    conforms: unknown
    evidence: >-
      Northmill acquires card payments and its security page describes an information
      security framework (confidentiality, integrity, availability, traceability) set by
      the Board, plus GDPR processes - but names NO certification. No SOC 2, ISO 27001,
      PCI DSS AoC or FedRAMP claim was found on any Northmill page.
domain_standards:
  description: >-
    Domain-standard signatures found in the contract itself (reward-only; absence is
    not a deficiency).
  found:
    - id: swedish-cash-register-control-unit
      name: Skatteverket kassaregister control unit (kontrollenhet)
      conforms: true
      evidence: >-
        definitions.MoreFlo.Models.InterfaceModels.Receipts.ControlUnit -
        "Represents a tax control unit and its associated control code", required
        `UnitId`, plus `ControlCode` "the control code received from the tax control
        unit", carried on every Receipt. This is the Swedish certified-cash-register
        control-unit stamp; a receipt without it is not a compliant Swedish sales
        record.
      scope: Swedish retail point of sale
      note: >-
        Not one of the signatures the catalog's domain_standard detector currently
        recognises (OData, SCIM, ActivityPub, OpenRTB, Sparkplug), recorded here as
        evidence rather than as a scored claim.
    - id: swedish-vat-reporting-shape
      name: Per-rate VAT breakdown on the receipt
      conforms: true
      evidence: >-
        Receipts.Vat requires VatRate, TotalVat and TotalAmount per rate, with the
        worked example "one article priced 5 SEK, with 25% VAT -> VatRate 25.0,
        TotalVat 1.0, TotalAmount 5.0".
  examined_and_absent:
    - {id: emv, note: 'BankCardTransaction carries terminal/acquirer fields (AcquirerId, ApprovalCode, AuthorizationMethod, DCC set) but declares no EMV tag structure and claims no EMV conformance.'}
    - {id: iso-20022, note: 'No ISO 20022 message types anywhere.'}
    - {id: gs1, note: 'ArticleBarcode is a free 20-char string; no GTIN/GS1 declaration.'}
    - {id: open-payments, note: absent}
    - {id: confirmation-of-payee, note: absent}
compliance_program:
  published: true
  certifications_named: []
  pages:
    - https://www.northmill.com/se-en/about-us/corporate-governance/
    - https://www.northmill.com/se-en/about-us/corporate-governance/risk-management/
    - https://www.northmill.com/se-en/about-us/security/
  regulator: Finansinspektionen (Swedish Financial Supervisory Authority)
  legal_entity: Northmill Bank AB, org.nr 556709-4866, Box 3616, 103 59 Stockholm
  note: >-
    Northmill publishes a governance/risk/security posture and its regulated status,
    but names no third-party certification. The `Compliance` pointer in apis.yml points
    at the corporate-governance page on that basis, not at a certification claim.