Skip to main content
APIContext
Talk to salesStart free
Start HereGuidesConceptsCLIReferenceChangelogStatus

FAPI 2.0

CONTRACT tier required

FAPI conformance profiles are available on CONTRACT tier accounts only. Contact your account manager to enable them. See plan availability and pricing.

FAPI 2.0 simplifies and strengthens the high-security profile around a single, well-defined Authorization Code flow, with the newest draft updated in 2024. Use it for new financial-grade integrations that target the current FAPI baseline rather than the older Read/Write profile.

How APImetrics checks it​

Our implementation of FAPI 2.0 is split into checkpoints, each containing multiple checks that confirm whether a particular observation is compliant.

This documentation focuses on compliance using the DPoP (Demonstrating Proof-of-Possession) sender-constraining mechanism. APImetrics is currently working on implementing the mTLS sender-constraining checks for the future. Where our checks intentionally diverge from the published FAPI 2.0 guidance (for performance reasons), it is called out on the relevant checkpoint below.

To turn this profile on and read its results, see the prerequisites and steps in Enable a standards profile.

Checkpoints​

Checkpoint R1: Network Layer Checks​

Looks at the network layer, for example your TLS certificate for the correct information and whether requests use HTTPS. (mTLS checks are planned for a future release.)

Checkpoint R2: Authentication Token Checks​

Looks at your authentication tokens, such as the DPoP and Authorization headers, for the correct information. A few checks from the original FAPI 2.0 documentation are evaluated in different checkpoints in the APImetrics check rather than here.

Checkpoint R3: DPoP Proof JWT Checks​

Looks at your DPoP headers and payloads to ensure the correct information is present. This checkpoint combines the original Section 8 of the FAPI 2.0 documentation, since APImetrics verifies DPoP conformance only. (mTLS checks are planned for a future release.)

Checkpoints R4 & R5: Access Token JWT Checks​

Looks at the headers and payloads of your JWT access tokens to ensure the correct information is present.

Checkpoint R6: Access Token JWT Signature Validation​

Looks at the headers and payloads of your JWT access tokens to ensure the correct information is present.

APImetrics completes a simplified version of the original FAPI 2.0 guidelines here: we do not obtain the public keys from your application, because doing so would significantly degrade conformance-check performance. For the same reason, the final check for the JWT header and JWT payload is not performed.

Checkpoint R8: Access Token Hash Check​

Looks at the access token to ensure the correct information is present.

See also​