generated: '2026-07-21'
method: derived
source: openapi/tweed-api-v2-openapi-original.json + docs.paytweed.com
standards:
  - id: oauth2
    conforms: false
    evidence: no oauth2 securityScheme; auth is http bearer (API key:secret / JWT)
  - id: oidc
    conforms: false
    evidence: /.well-known/openid-configuration absent on all hosts (404/403)
  - id: jwt-bearer-auth
    conforms: true
    evidence: >-
      openapi securitySchemes.bearer (type http, Bearer JWT); v1 API issues JWT
      access tokens via POST https://api-console.paytweed.com/auth/getAccessToken
  - id: rfc9457-problem-details
    conforms: false
    evidence: spec documents only 200/201 responses; no application/problem+json
  - id: rfc9116-security-txt
    conforms: false
    evidence: /.well-known/security.txt 404 on docs/www/api-console, 403 on api-v2
  - id: eip-1193
    conforms: true
    evidence: >-
      docs claim the Tweed EVM provider is EIP-1193 compliant for wagmi/EthersJS
      interoperability (https://docs.paytweed.com/products/waas)
  - id: erc-20
    conforms: true
    evidence: supported-blockchains page lists ERC-20 standard support per EVM chain
  - id: erc-721
    conforms: true
    evidence: supported-blockchains page lists ERC-721 standard support per EVM chain
  - id: hmac-webhook-signatures
    conforms: true
    evidence: >-
      webhooks signed with HMAC-SHA256 in X-Hub-Signature-256 (GitHub-style)
      per https://docs.paytweed.com/developer-tools/webhooks
  - id: pagination
    conforms: false
    evidence: no pagination parameters in any of the 36 spec paths
  - id: idempotency
    conforms: false
    evidence: >-
      no Idempotency-Key header in the API; webhook consumers get an
      X-Tweed-Delivery id for consumer-side dedup only
compliance_program:
  aml_kyc_policy: https://docs.paytweed.com/getting-started/token-checkout-or-payments/legacy-token-checkout/features/aml-and-kyc-policy-overview
  notes: >-
    Published AML & KYC policy: KYC required above $3,000 single / $10,000
    lifetime transactions; Stripe Radar transaction monitoring; Chainalysis
    wallet scanning. No SOC 2 / ISO 27001 / PCI certifications published and
    no trust center found (trust./security. subdomains do not resolve).