generated: '2026-07-21'
method: derived
source: openapi/river-markets-openapi-original.json
notes: >-
  Standards conformance derived from the OpenAPI and the documented auth/security model.
  River Markets uses a bespoke Ed25519 request-signing scheme rather than OAuth2/OIDC, and
  a FastAPI validation envelope rather than RFC 9457. No published compliance program
  (SOC 2 / ISO 27001 / PCI / etc.) was found, so no Compliance pointer is emitted.
standards:
- id: openapi-3.1
  conforms: true
  evidence: openapi field is 3.1.0
- id: ed25519-request-signing
  conforms: true
  evidence: apiKey security schemes X-River-Key-Id/X-River-Timestamp/X-River-Signature over an Ed25519 canonical string
- id: http-bearer-jwt
  conforms: true
  evidence: BearerAuth http/bearer scheme for the web client
- id: oauth2
  conforms: false
  evidence: no oauth2 security scheme in the spec
- id: openid-connect
  conforms: false
  evidence: no openIdConnect scheme; /.well-known/openid-configuration returns 404
- id: rfc9457-problem-details
  conforms: false
  evidence: errors use FastAPI HTTPValidationError (application/json), not application/problem+json
- id: rfc9116-security-txt
  conforms: false
  evidence: /.well-known/security.txt returns 404 on all hosts
- id: pagination-offset-limit
  conforms: true
  evidence: list endpoints accept limit and offset query parameters
- id: tls
  conforms: true
  evidence: api.rivermarkets.com serves TLSv1.3