Skip to main content
APIContext
Talk to salesStart free
Start HereGuidesConceptsCLIReferenceChangelogStatus

Conformance Explained

Conformance in APIContext measures whether your live API traffic matches a declared contract, typically an OpenAPI Specification (OAS) or a security profile standard like FAPI or UK Open Banking.

Two types of conformance​

Schema conformance​

APIContext compares each monitor's response against your imported OpenAPI Specification. It checks:

  • Response status codes: is the returned status code documented in the spec?
  • Response body structure: do field names, types, and required fields match the schema?
  • Headers: are required response headers present?

When a live response diverges from the spec, APIContext logs a conformance issue for the monitor.

Security profile conformance​

APIContext also tests against named security profiles: formal standards that define required behavior for financial and regulated APIs:

  • Basic Security: HTTPS and TLS 1.2 or higher
  • FAPI 2.0: Financial-grade API profile
  • FDX API 5.3: Financial Data Exchange (No PAR with MTLS, No PAR with Private Key JWT, and PAR)
  • OAuth 2.0: the OAuth 2.0 Security Best Current Practice
  • UK Open Banking: TLS Client Auth or Private Key JWT, in the original and v4 versions
  • New Zealand Open Banking

See Security Profiles for each one.

Each profile defines a set of assertions. A monitor either passes or fails each assertion, and the aggregate result appears in your project's conformance dashboard.

Conformance vs. monitoring​

Regular monitoring answers "is my API up and fast?" Conformance monitoring answers "is my API behaving correctly according to its contract?"

The two complement each other: a monitor can pass its latency and availability checks while still failing conformance if the API's response body changes shape.

Setting up conformance monitoring​

See Conformance guides for step-by-step instructions on importing a spec, running conformance checks, and interpreting results. For an overview of conformance capabilities including drift detection and audit trails, see API Conformance.

See also​