generated: '2026-07-24'
method: searched
source: >-
  https://auth.developers.auspayplus.com.au/.well-known/openid-configuration +
  https://www.auspayplus.com.au/solutions/npp-for-developers (NPP API Framework v5.0)
notes: >-
  NPP Australia is a scheme/rail operator; conformance is asserted for the
  cross-cutting standards its published surface demonstrates. ISO 20022 is the
  spine of the NPP API Framework. OAuth2/OIDC conformance is evidenced by the
  live Auth0 discovery document powering the developer portal. No provider-owned
  compliance-certification program (SOC 2 / ISO 27001 / PCI DSS attestation) was
  found published for AP+ itself; the PCI DSS reference on the portal is a
  product-feature claim about a BPAY service helping customers meet their own PCI
  requirements, not an AP+ certification — so no Compliance pointer is emitted.
standards:
- id: iso20022
  conforms: true
  evidence: NPP API Framework v5.0 is explicitly aligned to ISO 20022 messaging (auspayplus.com.au NPP-for-developers)
- id: oauth2
  conforms: true
  evidence: oauth-authorization-server discovery live at auth.developers.auspayplus.com.au (authorization_code + client_credentials grants)
- id: oidc
  conforms: true
  evidence: openid-configuration discovery live; openid/profile/email scopes advertised
- id: rfc9457-problem-details
  conforms: false
  evidence: no downloadable OpenAPI to confirm application/problem+json error envelope
- id: fapi
  conforms: false
  evidence: no published FAPI security-profile claim on the public portal surface