Added a compliance document to the official docs and specific compliant versions for each product

himeshsiriwardana · himeshsiriwardana · commit 04e30bb44f74 · 2025-11-13T12:10:00.000+05:30
diff --git a/en/identity-server/7.0.0/docs/deploy/compliance/fapi.md b/en/identity-server/7.0.0/docs/deploy/compliance/fapi.md
@@ -0,0 +1 @@
+{% include "../../../../../includes/deploy/compliance/fapi.md" %}
diff --git a/en/identity-server/7.0.0/docs/deploy/compliance/index.md b/en/identity-server/7.0.0/docs/deploy/compliance/index.md
@@ -10,4 +10,6 @@ Being compliant with industry regulations and law is a vital responsibility for
 
 - [FIPS]({{base_path}}/deploy/compliance/fips)
 
+- [FAPI]({{base_path}}/deploy/compliance/fapi)
+
 - [Accessibility Compliance]({{base_path}}/deploy/compliance/accessibility)
diff --git a/en/identity-server/7.0.0/mkdocs.yml b/en/identity-server/7.0.0/mkdocs.yml
@@ -809,6 +809,7 @@ nav:
           - eIDAS: deploy/compliance/eidas.md
           - CCPA: deploy/compliance/ccpa.md
           - FIPS: deploy/compliance/fips.md
+          - FAPI: deploy/compliance/fapi.md
           - Accessibility compliance: deploy/compliance/accessibility.md
       - Analytics:
         - Configure ELK analytics: deploy/elk-analytics-installation-guide.md
diff --git a/en/identity-server/7.1.0/docs/deploy/compliance/fapi.md b/en/identity-server/7.1.0/docs/deploy/compliance/fapi.md
@@ -0,0 +1 @@
+{% include "../../../../../includes/deploy/compliance/fapi.md" %}
diff --git a/en/identity-server/7.1.0/docs/deploy/compliance/index.md b/en/identity-server/7.1.0/docs/deploy/compliance/index.md
@@ -10,4 +10,6 @@ Being compliant with industry regulations and law is a vital responsibility for
 
 - [FIPS]({{base_path}}/deploy/compliance/fips)
 
+- [FAPI]({{base_path}}/deploy/compliance/fapi)
+
 - [Accessibility Compliance]({{base_path}}/deploy/compliance/accessibility)
diff --git a/en/identity-server/7.1.0/mkdocs.yml b/en/identity-server/7.1.0/mkdocs.yml
@@ -883,6 +883,7 @@ nav:
           - eIDAS: deploy/compliance/eidas.md
           - CCPA: deploy/compliance/ccpa.md
           - FIPS: deploy/compliance/fips.md
+          - FAPI: deploy/compliance/fapi.md
           - Accessibility compliance: deploy/compliance/accessibility.md
       - Analytics:
           - Configure ELK analytics: deploy/elk-analytics-installation-guide.md
diff --git a/en/identity-server/7.2.0/docs/deploy/compliance/fapi.md b/en/identity-server/7.2.0/docs/deploy/compliance/fapi.md
@@ -0,0 +1 @@
+{% include "../../../../../includes/deploy/compliance/fapi.md" %}
diff --git a/en/identity-server/7.2.0/docs/deploy/compliance/index.md b/en/identity-server/7.2.0/docs/deploy/compliance/index.md
@@ -10,4 +10,6 @@ Being compliant with industry regulations and law is a vital responsibility for
 
 - [FIPS]({{base_path}}/deploy/compliance/fips)
 
+- [FAPI]({{base_path}}/deploy/compliance/fapi)
+
 - [Accessibility Compliance]({{base_path}}/deploy/compliance/accessibility)
diff --git a/en/identity-server/7.2.0/mkdocs.yml b/en/identity-server/7.2.0/mkdocs.yml
@@ -17,7 +17,7 @@
 INHERIT: ../is_common.yml
 
 # Project information
-site_url: https://is.docs.wso2.com/en/next
+site_url: https://is.docs.wso2.com/en/7.2.0
 
 extra:
   base_path: /en/7.2.0
@@ -947,6 +947,7 @@ nav:
           - eIDAS: deploy/compliance/eidas.md
           - CCPA: deploy/compliance/ccpa.md
           - FIPS: deploy/compliance/fips.md
+          - FAPI: deploy/compliance/fapi.md
           - Accessibility compliance: deploy/compliance/accessibility.md
       - Analytics:
         - Configure ELK analytics: deploy/elk-analytics-installation-guide.md
diff --git a/en/identity-server/next/docs/deploy/compliance/fapi.md b/en/identity-server/next/docs/deploy/compliance/fapi.md
@@ -0,0 +1 @@
+{% include "../../../../../includes/deploy/compliance/fapi.md" %}
diff --git a/en/identity-server/next/docs/deploy/compliance/index.md b/en/identity-server/next/docs/deploy/compliance/index.md
@@ -10,4 +10,6 @@ Being compliant with industry regulations and law is a vital responsibility for
 
 - [FIPS]({{base_path}}/deploy/compliance/fips)
 
+- [FAPI]({{base_path}}/deploy/compliance/fapi)
+
 - [Accessibility Compliance]({{base_path}}/deploy/compliance/accessibility)
diff --git a/en/identity-server/next/mkdocs.yml b/en/identity-server/next/mkdocs.yml
@@ -947,6 +947,7 @@ nav:
           - eIDAS: deploy/compliance/eidas.md
           - CCPA: deploy/compliance/ccpa.md
           - FIPS: deploy/compliance/fips.md
+          - FAPI: deploy/compliance/fapi.md
           - Accessibility compliance: deploy/compliance/accessibility.md
       - Analytics:
         - Configure ELK analytics: deploy/elk-analytics-installation-guide.md
diff --git a/en/includes/deploy/compliance/fapi.md b/en/includes/deploy/compliance/fapi.md
@@ -0,0 +1,45 @@
+# Financial-grade API (FAPI)
+
+The Financial-grade API (FAPI) specifications, developed by the OpenID Foundation, define strict security requirements for OAuth 2.0 and OpenID Connect flows in financial and high-risk environments. FAPI compliance ensures that applications securely handle sensitive data, prevent token theft, mitigate replay attacks, and comply with industry standards for financial APIs.
+
+{{product_name}} implements [FAPI 1.0 – Advanced](https://openid.net/specs/openid-financial-api-part-2-1_0.html){: target="_blank"} {% if is_version == "7.1.0" %}and [FAPI 2.0](https://openid.net/specs/fapi-security-profile-2_0-final.html){: target="_blank"} profiles{% endif%} to help organizations achieve secure, standards-compliant API access.
+
+To create a FAPI compliant application, refer to the guide on [registering a FAPI-compliant application]({{base_path}}/guides/applications/register-a-fapi-compliant-app/).
+
+## FAPI 1.0 – Advanced compliance features
+
+{{product_name}} fully supports the FAPI 1.0 Advanced Security Profile:
+
+- **Mandatory Signed Request Objects**: Requests can be passed by value (request) or by reference (request_uri) for enhanced security.
+
+- **JWT Secured Authorization Response Mode (JARM)**: Authorization responses are returned as signed JWTs to ensure authenticity.
+
+- **Client Authentication**: Supports confidential clients using mutual TLS and Private Key JWT.
+
+- **Sender-Constrained Access Tokens**: Access tokens are bound to clients with Mutual TLS (MTLS).
+
+- **Secure Token Handling**: Access and refresh tokens are issued and validated according to FAPI 1.0 Advanced security requirements.
+
+These features protect financial API interactions against interception, forgery, and replay attacks.
+
+{% if is_version == "7.1.0" %}
+## FAPI 2.0 compliance features
+
+{{product_name}} supports FAPI 2.0 security profiles, including Read and Read/Write flows, with the following capabilities:
+
+- **Pushed Authorization Requests (PAR)**: Clients must push authorization requests to the `/par` endpoint, enhancing security by using back-channel communication.
+
+- **Proof Key for Code Exchange (PKCE)**: PKCE with the `S256` code challenge method is mandatory for authorization code flows.
+
+- **Authorization code** - Restrict response type to authorization code.
+
+- **Client Authentication**:  Supports confidential clients using mutual TLS and Private Key JWT.
+
+- **Sender-Constrained Access Tokens**: Access tokens are bound to clients via Mutual TLS (MTLS).
+
+- **Secure Token Handling**: Access and refresh tokens are issued and validated according to FAPI 2.0 Advanced security requirements.
+{% endif %}
+
+{{product_name}} undergoes continuous security reviews and updates. Compliance with the latest FAPI specifications is verified with every release. Cryptographic algorithms and frameworks are updated to meet industry standards. New security features and compliance enhancements are integrated without disrupting existing deployments.
+
+Organizations deploying {{product_name}} can confidently achieve FAPI 1.0 Advanced {% if is_version == "7.1.0" %}and FAPI 2.0{% endif %} compliance, protecting financial data, reducing operational risk, and simplifying regulatory adherence.
diff --git a/en/includes/guides/applications/register-a-fapi-compliant-app.md b/en/includes/guides/applications/register-a-fapi-compliant-app.md
@@ -1,6 +1,6 @@
 # Register a FAPI-compliant application
 
-Financial-Grade API (FAPI) specification extends the OAuth and OIDC frameworks and defines additional technical requirements to protect high-value APIs. {% if is_version == "7.1.0" %}{{product_name}} provides full support for both FAPI 1.0 Advanced and FAPI 2.0 allowing developers to build applications that meet these advanced security standards.{% endif %}
+Financial-Grade API (FAPI) specification extends the OAuth and OIDC frameworks and defines additional technical requirements to protect high-value APIs. {% if is_version == "7.1.0" %}{{product_name}} provides full support for both [FAPI 1.0 Advanced](https://openid.net/specs/openid-financial-api-part-2-1_0.html){: target="_blank"} and [FAPI 2.0](https://openid.net/specs/fapi-security-profile-2_0-final.html){: target="_blank"} allowing developers to build applications that meet these advanced security standards.{%else%}{{product_name}} provides full support for [FAPI 1.0 Advanced](https://openid.net/specs/openid-financial-api-part-2-1_0.html){: target="_blank"} allowing developers to build applications that meet advanced security standards.{% endif %}
 
 This guide walks you through creating and configuring a FAPI-compliant application in WSO2 Identity Server.
 

Original file line number	Diff line number	Diff line change
`@@ -0,0 +1 @@`
	`1`	`+{% include "../../../../../includes/deploy/compliance/fapi.md" %}`