generated: '2026-08-02'
method: searched
source:
  - https://developers.tradeshift.com/docs/api
  - https://tradeshift.com/security/
  - openapi/tradeshift-external-api-openapi.yml
  - https://mcp.tradeshift.com/.well-known/oauth-protected-resource
standards:
  - id: oauth1
    conforms: true
    evidence: >-
      Two-legged OAuth 1.0a with HMAC-SHA1 signing documented on api.tradeshift.com and in the developer center;
      marked by Tradeshift as deprecated / backward-compatibility only.
  - id: oauth2
    conforms: true
    evidence: >-
      Three-legged OAuth 2.0 for apps (authorize at go.tradeshift.com/oauth2/authorize, token at
      api.tradeshift.com/tradeshift/auth/token) and client-credentials OAuth 2.0 on the MCP server.
  - id: rfc8414-oauth-authorization-server-metadata
    conforms: true
    evidence: >-
      /.well-known/oauth-authorization-server returns 200 application/json on both api.tradeshift.com/tradeshift/
      and mcp.tradeshift.com.
  - id: rfc9728-oauth-protected-resource-metadata
    conforms: true
    evidence: >-
      https://mcp.tradeshift.com/.well-known/oauth-protected-resource returns 200 with resource,
      authorization_servers, scopes_supported and bearer_methods_supported.
  - id: oidc
    conforms: false
    evidence: >-
      mcp.tradeshift.com/.well-known/openid-configuration returns 404 with body "Not an OpenID Connect provider";
      the platform authorization server exposes jwks_uri and userinfo_endpoint but publishes no OIDC discovery
      document.
  - id: openapi-3
    conforms: true
    evidence: >-
      OpenAPI 3.0.0 for the External API served from developers.tradeshift.com/rest/docs/api; OpenAPI 3.1.0 for the
      MCP HTTP bridge served from mcp.tradeshift.com/openapi.json.
  - id: mcp
    conforms: true
    evidence: >-
      Production MCP server at https://mcp.tradeshift.com/mcp with stdio and HTTP+SSE transports and OAuth-protected
      resource metadata; tools/list responds with a JSON-RPC-shaped 401 invalid_token when unauthenticated.
  - id: oasis-ubl-2.1
    conforms: true
    evidence: >-
      Business documents are exchanged as OASIS UBL (TSUBL profile, a subset of UBL 2.0/2.1). Tradeshift publishes
      the UBL XSDs, JSON Schemas and example documents itself (com.tradeshift:tradeshift-ubl-xsd,
      tradeshift-ubl-jsonschema, tradeshift-ubl-examples).
  - id: json-schema-draft-04
    conforms: true
    evidence: The harvested Tradeshift UBL JSON Schemas declare $schema http://json-schema.org/draft-04/schema#.
  - id: peppol
    conforms: true
    evidence: >-
      Tradeshift publishes Peppol e-invoicing framework material and positions itself as a Peppol-capable network
      (https://tradeshift.com/resources/compliance/7-crucial-things-to-know-about-peppol-webinar). Not evidenced in
      the API contract itself.
  - id: rfc4122-uuid
    conforms: true
    evidence: >-
      Resource identifiers are RFC 4122 UUIDs; the OpenAPI enforces the canonical hyphenated hex pattern on request
      bodies.
  - id: iso-4217
    conforms: true
    evidence: Currency codes follow ISO 4217 per the key-concepts documentation.
  - id: iso-3166
    conforms: true
    evidence: Country codes follow ISO 3166 per the key-concepts documentation.
  - id: unece-5305-tax-category
    conforms: true
    evidence: Tax category codes follow UN/ECE 5305 per the key-concepts documentation.
  - id: unece-5153-tax-scheme
    conforms: true
    evidence: Tax scheme codes follow a UN/ECE 5153 subset per the key-concepts documentation.
  - id: unece-rec20-units
    conforms: true
    evidence: Units of measure follow UN/ECE recommendation 20 per the key-concepts documentation.
  - id: rfc9457-problem-details
    conforms: false
    evidence: >-
      Errors use a proprietary {ErrorCode, Message, ErrorDetail[]} envelope in application/json or text/xml; no
      application/problem+json anywhere in the spec.
  - id: rfc8594-sunset-header
    conforms: false
    evidence: >-
      A published deprecation process exists (9/6/3-month milestones) but no Sunset or Deprecation response headers
      are documented or declared in the spec.
  - id: json-api
    conforms: false
  - id: odata
    conforms: false
  - id: scim
    conforms: false
  - id: fhir
    conforms: false
  - id: fapi
    conforms: false
  - id: psd2
    conforms: false
  - id: idempotency-key-header
    conforms: false
    evidence: >-
      No Idempotency-Key header. Idempotency is achieved through client-assigned resource UUIDs on PUT — see
      conventions/tradeshift-conventions.yml.
  - id: rate-limit-headers
    conforms: false
    evidence: No 429 response and no RateLimit headers in any of the 172 operations; no published rate-limit policy.
compliance_program:
  published: true
  url: https://tradeshift.com/security/
  certifications:
    - SOC 1 Type II
    - SOC 2 Type II
    - ISAE 3402 Type II
    - PCI DSS Level 1
    - ISO 27001
  quote: >-
    "Our rigorous and ever-expanding compliance program includes 3rd party audits that enable us to provide our
    customers reports validating the security of the platform with standards such as SOC 1 Type II, SOC 2 Type II,
    ISAE 3402 Type II, Payment Card Industry (PCI-DSS) Level 1 and ISO 27001."
  regulatory_context:
    - e-invoicing compliance in 69 countries (per tradeshift.com meta description)
    - French e-invoicing mandate — Tradeshift registered as a PDP (Plateforme de Dématérialisation Partenaire)
    - GDPR