generated: '2026-09-01'
method: searched
source: https://apidocs.tzero.com/docs
sources:
- https://apidocs.tzero.com/docs
- https://apidocs.tzero.com/docs/fix
- https://www.tzero.com/legal
- openapi/tzero-issuance-secondary-markets-openapi.json
- openapi/tzero-institutional-openapi.json
standards:
- id: fix-4.2
  name: FIX Protocol 4.2
  conforms: true
  domain_standard: true
  evidence: >-
    tZERO publishes a full FIX 4.2 Order Entry Specification (New Order Single MsgType=D,
    Order Cancel Request, Order Cancel/Replace Request, execution reports) and a FIX 4.2 IOI
    Market Data Specification, tag by tag, at https://apidocs.tzero.com/docs/fix/order-entry
    and /docs/fix/ioi-market-data. Non-standard tags are explicitly labelled as such
    (e.g. 8721-8723 MWCBLvl1-3Prx, 8724 ShortSellRstrcn).
  spec_location: https://apidocs.tzero.com/docs/fix/order-entry
- id: fix-4.4
  name: FIX Protocol 4.4
  conforms: true
  domain_standard: true
  evidence: >-
    FIX 4.4 DROPCOPY Specification (execution reports MsgType=8 for acknowledgements, fills,
    cancels, rejects, busts and trade corrections) and FIX 4.4 Market Data Specification
    (Market Data Request/Snapshot/Incremental Refresh, Trading Session Status, Security Status),
    both dated December 2025.
  spec_location: https://apidocs.tzero.com/docs/fix/market-data
- id: openapi-3.0
  conforms: true
  evidence: two published OpenAPI 3.0.3 documents (Issuance & Secondary Markets, Institutional)
- id: oauth2
  conforms: false
  evidence: no oauth2 securityScheme in either contract; auth is api-key plus an opaque bearer JWT
- id: oidc
  conforms: false
  evidence: /.well-known/openid-configuration returns 404 on every tZERO host
- id: rfc9457-problem-details
  conforms: false
  evidence: no application/problem+json responses; both surfaces use vendor error envelopes
- id: rfc9116-security-txt
  conforms: false
  evidence: /.well-known/security.txt returns 404 on every tZERO host (well-known/tzero-well-known.yml)
- id: rfc8594-sunset-header
  conforms: false
  evidence: no deprecation or sunset policy published
- id: idempotency
  conforms: true
  evidence: >-
    Idempotency-Key header on Institutional dividend/corporate-action/proposal mutations
    (409 on key reuse with a different payload); idempotencyKey field on transfers and
    issuances; client-supplied transactionId on Issuance & Secondary Markets investments and orders
- id: pagination
  conforms: true
  evidence: Institutional list endpoints take page/perPage and return a pagination object (total, page, perPage, totalPages)
- id: webhooks-hmac-sha256
  conforms: true
  evidence: Institutional webhook payloads are signed with HMAC-SHA256 using a per-subscription secret
- id: jwt
  conforms: true
  evidence: bearerAuth securityScheme with bearerFormat JWT on the Issuance & Secondary Markets API
- id: iso-3166-country-codes
  conforms: true
  evidence: >-
    Government-identifier and jurisdiction validation requires two-letter ISO country codes
    (GOVERNMENT_IDENTIFIER_COUNTRY_INVALID — "must be a two-letter ISO code")
- id: iso-20022
  conforms: false
  evidence: no ISO 20022 message types appear in either contract
- id: scim
  conforms: false
- id: odata
  conforms: false
- id: asyncapi
  conforms: false
  evidence: webhooks are documented inside the OpenAPI description; no AsyncAPI document is published
regulatory:
  regime: financial-services / us-securities
  note: >-
    These are regulatory registrations and published disclosures, not third-party security
    certifications. No SOC 2, ISO 27001, PCI DSS or FedRAMP attestation was found on any
    tZERO host, and no trust center exists (security/tzero-trust-center.yml was not written
    because the probe found none).
  registrations:
  - {body: SEC, item: registered broker-dealer, entity: tZERO Securities LLC}
  - {body: FINRA, item: member firm operating the tZERO ATS (continuously since 2019)}
  - {body: SEC, item: special purpose broker-dealer (SPBD) for digital asset securities}
  - {body: SEC, item: registered transfer agent, evidence: 'SEC Rule 17Ad-2 turnaround timer referenced in the Institutional API description'}
  - {body: CFTC/NFA, item: introducing broker registration and NFA membership approved; DCO and DCM applications filed}
  published_disclosures:
    url: https://www.tzero.com/legal
    documents:
    - tZERO Securities Form CRS
    - tZERO Digital Form CRS
    - tZERO Securities Statement of Financial Condition
    - tZERO Digital Statement of Financial Condition
    - tZERO Digital Customer Custody Agreement
    - tZERO Securities Customer Agreement
    - tZERO Extended Hours Trading Risk Disclosure
    - Privacy Policy and Privacy Notices (TDAS and tZERO Securities)
    - tZERO Master Terms of Use