generated: '2026-08-05'
method: searched
source: >-
  https://developer.uphold.com/rest-apis/authentication, /rest-apis/errors, /rest-apis/pagination,
  /rest-apis/webhooks, https://uphold.com/en-us/get-started/security,
  https://uphold.com/.well-known/security.txt — plus derivation from openapi/*.json
standards:
- id: openapi-3.1
  conforms: true
  evidence: >-
    Five published specs all declare openapi 3.1.0 — core, widgets, topper, market-pulse and
    kyc-connector — served from developer.uphold.com/_media/specs/ and indexed in the published llms.txt.
- id: oauth2
  conforms: true
  evidence: >-
    components.securitySchemes.OAuth2 type oauth2 with a clientCredentials flow in every spec; 64
    distinct scopes; global security requirement on all five documents.
- id: oauth2-client-credentials
  conforms: true
  evidence: RFC 6749 §4.4. The only grant Uphold supports on the Enterprise APIs.
- id: rfc8414-oauth-authorization-server-metadata
  conforms: false
  evidence: >-
    /.well-known/oauth-authorization-server returns 503 on the production API host and 404 on the
    sandbox host. No discovery document is published.
- id: oidc
  conforms: false
  evidence: /.well-known/openid-configuration returns 404/503 on every host probed. No openIdConnect scheme in any spec.
- id: rfc9457-problem-details
  conforms: false
  evidence: >-
    Errors are plain application/json with {code, message, details}; no application/problem+json content
    type anywhere in the five specs. See errors/uphold-problem-types.yml.
- id: rfc9116-security-txt
  conforms: true
  evidence: https://uphold.com/.well-known/security.txt returns 200 with Policy, Contact, Encryption, Preferred-Languages and Expires fields.
- id: rfc8594-sunset-header
  conforms: false
  evidence: No Sunset or Deprecation header support is documented; deprecation is announced in the dated changelog only.
- id: json-api
  conforms: false
  evidence: Custom JSON envelope; no JSON:API media type or document structure.
- id: pagination
  conforms: true
  evidence: >-
    Documented and standardized — a `pagination` object carrying first/next/previous URLs plus a
    `perPage` parameter, spanning both page-based and cursor-based implementations.
- id: idempotency
  conforms: false
  evidence: >-
    Zero occurrences of "idempoten" across the full 1.17 MB published docs dump and across all five
    OpenAPI documents. No idempotency key on any write, including POST /core/transactions.
- id: standard-webhooks
  conforms: true
  evidence: >-
    Webhook delivery is Svix-backed, using the Standard Webhooks signature headers Webhook-Id,
    Webhook-Timestamp and Webhook-Signature.
- id: asyncapi
  conforms: false
  evidence: >-
    No AsyncAPI document is published. The 30-event surface is declared inline in OpenAPI 3.1 `webhooks`
    objects instead — captured in asyncapi/uphold-core-webhooks.yml.
- id: a2a
  conforms: true
  evidence: >-
    A conformant A2A agent card is served at https://developer.uphold.com/.well-known/agent-card.json
    (protocolVersion 0.3, capabilities object, skills array). Graded in a2a/uphold-a2a.yml.
- id: mcp
  conforms: true
  evidence: >-
    Live anonymous MCP server at https://developer.uphold.com/mcp speaking protocol 2025-06-18 over
    streamable HTTP, with a /.well-known/mcp.json discovery document. Documentation scope only.
- id: llms-txt
  conforms: true
  evidence: https://developer.uphold.com/llms.txt (200) plus /llms-full.txt (200, 1.17 MB).
- id: fatf-travel-rule
  conforms: true
  evidence: >-
    First-class Travel Rule product — deposit and withdrawal flows, a Travel Rule Widget, and
    transaction requests-for-information operations for resolving an on-hold transfer.
  docs: https://developer.uphold.com/developer-guides/travel-rule/overview
- id: iso3166
  conforms: true
  evidence: Country and subdivision codes on users, addresses and the X-Uphold-User-Country/Subdivision context headers.
- id: json-schema
  conforms: true
  evidence: >-
    Dynamic forms are published as JSON Schema plus a UI Schema based on the JSON Forms specification,
    with dedicated reference pages for both.
- id: psd2
  conforms: false
  evidence: Not claimed. Uphold's UK entity is FCA-regulated as an Electronic Money Issuer, but no PSD2/Open Banking API conformance is asserted.
- id: fapi
  conforms: false
  evidence: No FAPI security profile is claimed and no mTLS/PAR/JARM machinery appears in the specs.
compliance_program:
  published: true
  page: https://uphold.com/en-us/get-started/security
  certifications:
  - SOC 2 Type 2
  - ISO 27001
  - PCI DSS
  regulatory:
  - FinCEN registered Money Services Business (US)
  - FCA Electronic Money Issuer (UK)
  - Bank Secrecy Act / AML program
  - OFAC sanctions screening
  privacy_regimes: [GDPR, CCPA, PIPEDA, UK Data Protection Act]
  trust_center: security/uphold-trust-center.yml
  note: >-
    Certification names are taken verbatim from Uphold's own public security page. No third-party audit
    report or certificate was retrieved, so this records the CLAIM and where it is published, not an
    independent verification.