generated: '2026-07-20'
method: derived
source:
- openapi/qfex-openapi-original.yml
- asyncapi/qfex-trade-asyncapi.yml
- asyncapi/qfex-mds-asyncapi.yml
standards:
- id: openapi-3.1
  conforms: true
  evidence: REST API published as OpenAPI 3.1.0.
- id: asyncapi-3.0
  conforms: true
  evidence: Market-data and trade WebSocket gateways published as AsyncAPI 3.0.0.
- id: hmac-request-signing
  conforms: true
  evidence: HMAC-SHA256 signed requests with nonce + timestamp replay protection.
- id: oauth2
  conforms: false
  evidence: No oauth2 security schemes; auth is API-key + HMAC signature.
- id: oidc
  conforms: false
- id: rfc9457-problem-details
  conforms: false
  evidence: Errors use a custom envelope, not application/problem+json.
- id: rfc8594-sunset-header
  conforms: false
  evidence: No documented Sunset/Deprecation header policy.
- id: rfc9116-security-txt
  conforms: false
  evidence: No /.well-known/security.txt served (bug bounty documented in docs instead).
compliance_program: null
note: >-
  Derived assertions about spec/standards conformance only. No published third-party
  certifications (SOC 2, ISO 27001, PCI DSS, etc.) were found, so no Compliance
  pointer is emitted.