generated: '2026-07-21'
method: derived
source: docs.sfox.com (auth, errors, endpoints) + apis.yml
standards:
- id: oauth2
  conforms: false
  evidence: Auth is a static bearer API key, not OAuth2.
- id: oidc
  conforms: false
- id: rfc9457-problem-details
  conforms: false
  evidence: Errors returned as HTTP status + plain JSON, not application/problem+json.
- id: rfc9116-security-txt
  conforms: false
  evidence: No /.well-known/security.txt (404).
- id: rest-json
  conforms: true
  evidence: JSON over HTTPS REST API; non-JSON Accept returns 406.
- id: websocket-streaming
  conforms: true
  evidence: wss://ws.sfox.com/ws pub/sub feed API (see asyncapi/).
- id: fix-protocol
  conforms: true
  evidence: FIX Order Entry + FIX Market Data sessions documented (QuickFIX guide).
- id: rate-limiting
  conforms: true
  evidence: Documented IP + route rate limits, 429 on breach.
- id: idempotency
  conforms: false
  evidence: No idempotency-key mechanism documented.
notes: >-
  Derived from documented behavior. sFOX SAFE custody is operated via SAFE Trust
  Company (a regulated trust); no specific security certifications (SOC 2/ISO
  27001/PCI) were found published, so no Compliance pointer is asserted.