generated: '2026-08-02'
method: derived
source: >-
  openapi/shopback-online-payments-openapi.yml +
  openapi/shopback-in-store-payments-openapi.yml +
  https://docs.shopback.com/docs/quickstart-api +
  https://docs.shopback.com/reference/generating-hmac-signature +
  https://docs.shopback.com/reference/key-concepts
summary: >-
  ShopBack's published APIs are plain REST/JSON over TLS with two proprietary
  auth models (merchant JWT bearer, and an SB1-HMAC-SHA256 request signature).
  No OAuth 2.0, OIDC, FAPI, PSD2, Open Banking or other regulated-payments
  profile is asserted or evidenced, and no compliance certification is published
  on any ShopBack host.
standards:
- id: rest
  conforms: true
  evidence: >-
    "This API is organized around REST (REpresentational State Transfer) and uses
    predictable, resource-oriented URLs" — https://docs.shopback.com/docs/quickstart-api
- id: openapi-3.0
  conforms: true
  evidence: >-
    Both APIs are documented with OpenAPI 3.0.1 definitions published per
    operation on docs.shopback.com reference pages.
- id: tls-1.2-minimum
  conforms: true
  evidence: >-
    "All communication needs to be secured using HTTPS with TLS 1.2 (or greater)"
    — https://docs.shopback.com/docs/quickstart-api; live probe observed TLSv1.3
    on www.shopback.com, docs.shopback.com and prod-merchant-service.hoolah.co.
- id: http-bearer-jwt
  conforms: true
  evidence: >-
    components.securitySchemes.bearer (type http, scheme bearer, bearerFormat JWT)
    in openapi/shopback-online-payments-openapi.yml.
- id: hmac-request-signing
  conforms: true
  evidence: >-
    SB1-HMAC-SHA256 signature over method, content-type, ISO-8601 UTC date, fully
    qualified path and a SHA-256 digest of the alphabetically sorted JSON body —
    https://docs.shopback.com/reference/generating-hmac-signature
- id: idempotency-key
  conforms: true
  evidence: >-
    X-ShopBack-Idempotent-Id (UUID v4) required on state-changing operations —
    https://docs.shopback.com/reference/key-concepts
- id: iso-8601
  conforms: true
  evidence: Date header and all timestamps are ISO-8601 UTC.
- id: iso-3166-1-alpha
  conforms: true
  evidence: In-Store Payments API country codes use ISO-3166-1 alpha (change log v1.2).
- id: iso-4217
  conforms: true
  evidence: Currency fields use three-letter currency codes (SGD, MYR, THB, HKD).
- id: rfc9457-problem-details
  conforms: false
  evidence: >-
    Errors use a proprietary {statusCode, error, message} envelope over
    application/json; no application/problem+json media type is used.
- id: oauth2
  conforms: false
  evidence: >-
    No oauth2 securityScheme in either spec; no /.well-known/oauth-authorization-server
    on any host (404). Account linking uses a ShopBack-hosted consent page with a
    single-use auth code, which is OAuth-shaped but is not an OAuth 2.0 profile
    and publishes no authorization/token endpoint metadata.
- id: openid-connect
  conforms: false
  evidence: /.well-known/openid-configuration returned 404 on every probed host.
- id: rfc8594-sunset
  conforms: false
  evidence: No Sunset or Deprecation header support is documented.
- id: rfc9116-security-txt
  conforms: false
  evidence: /.well-known/security.txt returned 404 on every probed host.
- id: json-api
  conforms: false
- id: odata
  conforms: false
- id: scim
  conforms: false
- id: fhir
  conforms: false
- id: psd2
  conforms: false
  evidence: >-
    ShopBack operates in APAC/EU consumer rewards and merchant payments; no PSD2,
    Open Banking or SCA conformance is claimed in the developer documentation.
- id: fapi
  conforms: false
- id: pci-dss
  conforms: unknown
  evidence: >-
    No PCI DSS attestation is published on any ShopBack host. ShopBack Pay is a
    wallet/redirect and tokenized-payment model in which card data is not handled
    by the merchant integration, but ShopBack publishes no compliance page to
    confirm its own posture.
compliance_program:
  published: false
  note: >-
    No trust center, compliance page or named certification (SOC 2, ISO 27001,
    PCI DSS, HIPAA, FedRAMP) was found on shopback.com, corporate.shopback.com,
    docs.shopback.com or any subdomain. corporate.shopback.com is a single-page
    app that answers HTTP 200 with the same homepage for every path, so its
    /trust-safety/* links do not resolve to distinct served documents. No
    `Compliance` pointer was wired for this reason.