Skip to main content
APIContext
Talk to salesStart free
Start HereGuidesConceptsCLIReferenceChangelog

FAPI 2.0

CONTRACT tier required

FAPI conformance profiles are available on CONTRACT tier accounts only. Contact your account manager to enable them. See plan availability and pricing.

FAPI 2.0 is the successor to FAPI-RW-ID2. It simplifies and strengthens the high-security profile around a single, well-defined Authorization Code flow, with the newest draft updated in 2024. Use it for new financial-grade integrations that target the current FAPI baseline rather than the older Read/Write profile.

How APImetrics checks it​

Our implementation of FAPI 2.0 is split into checkpoints, each containing multiple checks that confirm whether a particular observation is compliant.

This documentation focuses on compliance using the DPoP (Demonstrating Proof-of-Possession) sender-constraining mechanism. APImetrics is currently working on implementing the mTLS sender-constraining checks for the future. Where our checks intentionally diverge from the published FAPI 2.0 guidance (for performance reasons), it is called out on the relevant checkpoint below.

Prerequisites​

  • A monitor (or workflow) that exercises the Authorization Code flow with DPoP, so the token and resource-server checks have traffic to evaluate.
  • DPoP proof JWTs and Authorization headers present on the monitored requests.
  • Requests classified correctly by stage; workflows are the easiest way to capture an end-to-end flow.

Enabling the profile​

  1. Go to Project Settings → Conformance.
  2. Under Security Profiles, select FAPI 2.0.
  3. Save changes.
  4. Run your monitors (or select Evaluate Most Recent Calls on the Conformance Summary) to generate results.

Interpreting results​

Conformance results appear in INVESTIGATE → Conformance. Each row corresponds to a checkpoint below and can be expanded to see the individual checks and the specification section they map to. For triage workflow, see Issue Details.

Checkpoints​

Checkpoint R1 — Network Layer Checks​

Looks at the network layer — for example, your TLS certificate for the correct information and whether requests use HTTPS. (mTLS checks are planned for a future release.)

Checkpoint R2 — Authentication Token Checks​

Looks at your authentication tokens, such as the DPoP and Authorization headers, for the correct information. A few checks from the original FAPI 2.0 documentation are evaluated in different checkpoints in the APImetrics check rather than here.

Checkpoint R3 — DPoP Proof JWT Checks​

Looks at your DPoP headers and payloads to ensure the correct information is present. This checkpoint combines the original Section 8 of the FAPI 2.0 documentation, since APImetrics verifies DPoP conformance only. (mTLS checks are planned for a future release.)

Checkpoints R4 & R5 — Access Token JWT Checks​

Looks at the headers and payloads of your JWT access tokens to ensure the correct information is present.

Checkpoint R6 — Access Token JWT Signature Validation​

Looks at the headers and payloads of your JWT access tokens to ensure the correct information is present.

APImetrics completes a simplified version of the original FAPI 2.0 guidelines here: we do not obtain the public keys from your application, because doing so would significantly degrade conformance-check performance. For the same reason, the final check for the JWT header and JWT payload is not performed.

Checkpoint R8 — Access Token Hash Check​

Looks at the access token to ensure the correct information is present.

See also​