generated: '2026-07-23'
method: searched
source: >-
  https://developer.payments.ca/payments-canada-api-standards + derivation from
  openapi/ securitySchemes, message schemas, and conventions
standards:
- id: iso-20022
  conforms: true
  evidence: >-
    RTR rails implement ISO 20022 message types verbatim — pacs.008 (customer
    credit transfer), pacs.028 (status request), pacs.002 (status report),
    admi.004/admi.011 (system event heartbeat), admi.002 (message reject),
    camt.003/camt.004 (account query/return). Payments Canada API Standards
    mandate ISO 20022 JSON messaging.
- id: oauth2
  conforms: true
  evidence: openapi securitySchemes type oauth2, clientCredentials flow, tokenUrl https://api.payments.ca/accesstoken
- id: jws-jose
  conforms: true
  evidence: RTR request/response payloads are JWS-signed via the x-jws-signature header (RFC 7515)
- id: rest-media-type-versioning
  conforms: true
  evidence: API Standards mandate Accept-header (media-type) versioning; content negotiated as application/vnd.api.v1+json
- id: pagination
  conforms: true
  evidence: FIF/CCIN extract endpoints support page/limit/sortField/sortOrder query pagination
- id: tls-https
  conforms: true
  evidence: API Standards require SSL/HTTPS for all API calls; all servers use https
- id: rfc9457-problem-details
  conforms: false
  evidence: errors use vendor media type application/vnd.api.v1+json (ErrorModel), not application/problem+json
- id: openid-connect
  conforms: false
  evidence: no OIDC discovery document or openIdConnect scheme published
- id: idempotency-key
  conforms: false
  evidence: no documented idempotency-key header/parameter
- id: fapi
  conforms: false
  evidence: no FAPI security profile claimed; client-credentials without PKCE/PAR
- id: psd2
  conforms: false
  evidence: Canadian infrastructure; not subject to EU PSD2
regulatory_context:
  note: >-
    Payments Canada is a public-purpose organization established by the Canadian
    Payments Act, overseen by the Bank of Canada and the Minister of Finance.
    This is statutory oversight of national clearing/settlement infrastructure,
    not a published third-party security certification (no SOC 2 / ISO 27001 /
    PCI DSS attestation is advertised on the developer portal), so no Compliance
    pointer is emitted.