Skip to main content
APIContext
Talk to salesStart free
Start HereGuidesConceptsCLIReferenceChangelogStatus

Conformance Explained

Conformance in APIContext measures whether your live API traffic matches a declared contract, typically an OpenAPI Specification (OAS) or a security profile standard like FAPI or UK Open Banking.

Types of conformance​

Schema conformance​

APIContext compares each monitor's response against your imported OpenAPI Specification. It checks:

  • Response status codes: is the returned status code documented in the spec?
  • Response body structure: do field names, types, and required fields match the schema?
  • Headers: are required response headers present?

When a live response diverges from the spec, APIContext logs a conformance issue for the monitor.

Security profile conformance​

APIContext also tests against named security profiles: formal standards that define required behavior for financial and regulated APIs:

  • Basic Security: HTTPS and TLS 1.2 or higher
  • FAPI 2.0: Financial-grade API profile
  • FDX API 5.3: Financial Data Exchange (No PAR with MTLS, No PAR with Private Key JWT, and PAR)
  • OAuth 2.0: the OAuth 2.0 Security Best Current Practice
  • UK Open Banking: TLS Client Auth or Private Key JWT, in the original and v4 versions
  • New Zealand Open Banking

See Security Profiles for each one.

Each profile defines a set of assertions. A monitor either passes or fails each assertion, and the aggregate result appears in your project's conformance dashboard.

Data conformance​

A data check is a set of rules about the content of a result: how many items a list holds and what each item contains. It applies to every monitor that carries the check's tag. When a later result differs from what the rules expect, APIContext logs a Data conformance issue.

For an MCP monitor, you create a data check from a result you trust: mark a step's result as expected, and later results of that step are checked against it. Each step of the session is checked separately. See Set an MCP step's result as expected.

Conformance vs. monitoring​

Regular monitoring answers "is my API up and fast?" Conformance monitoring answers "is my API behaving correctly according to its contract?"

The two complement each other: a monitor can pass its latency and availability checks while still failing conformance if the API's response body changes shape.

Setting up conformance monitoring​

See Conformance guides for step-by-step instructions on importing a spec, running conformance checks, and interpreting results. For an overview of conformance capabilities including drift detection and audit trails, see API Conformance.

See also​