Skip to content

FAPI_Meeting_Notes_2025 01 29_Atlantic

Jump to bottom
Nat Sakimura edited this page Jul 10, 2026 · 1 revision

FAPI WG Meeting Notes (2025-01-29)

Attendees

  • Nat Sakimura (Chair)
  • Mike Leszcz (OIDF)
  • Joseph Heenan (OIDF & Authlete)
  • Dima Postnikov
  • Filip Skokan
  • Brian Campbell
  • Imran Ulghar (OBL)
  • Hideki Ikeda
  • Lukasz Jaromin
  • Chris Wood
  • Robert Gallagher (Mastercard)
  • Kosuke Koiwai
  • Peter Wallach (Mastercard)
  • Bjorn Hjelm
  • Kelley Burgin

Regret

  • Dave Tonge

Agenda

  1. Roll Call
  2. Adoption of Agenda
  3. Events
  4. External Orgs & Liaisons
  5. PRs
  6. Issues
  7. AOB

Events Update (Mike Leszcz)

Upcoming Events

  • OSW 2025: February 26-28 in Reykjavik, Iceland
    • Certification team meeting: February 24-25
    • DCP Working Group meeting: February 25
  • DICE: March 4-5 in Zurich
  • ISO/IEC JTC 1/SC 27/WG5: March 10-15, 2025 in Fairfax
  • ISO/IEC JTC 1/SC 27: March 17-18, 2025 in Fairfax
  • MOSIP Connect: March 11-13 in Philippines
  • IETF Bangkok: March 15-21
  • OIDF Workshop prior to IIW: April 7
  • IIW Spring 2025: April 8-10

Outreach Updates

  1. Brazil Recertifications
    • Open Finance Brazil and Open Insurance Brazil recertifications proceeding smoothly
  2. United Arab Emirates
    • All tests now in production, including OP test
    • Certifications are open
  3. Rwanda Initiative
    • Met with Senfry (African impact agency advising National Bank of Rwanda)
    • Rwanda developing first nationally adopted Open API standards in Africa
    • OIDF invited to participate in Rwanda's technical forum (March 25-26)
    • Mark Haines likely to represent OIDF

FAPI 2 Voting Schedule

  • Vote announcement published: January 24, 2025
  • Early voting opens: February 1, 2025
  • Voting period: February 8-15, 2025

Pull Requests Review

  1. PR #530

    • Non-controversial
    • Adding reference to cross-device flows security best current practice
    • Awaiting review and approval

  2. PR #531

    • Editorial change from Mike Jones
    • Title update to indicate Draft 10 incorporating Route Set 1
    • Awaiting review and approval

  3. PR #529

    • CIBA-related
    • Dave not present for discussion
    • Awaiting review

Issues Discussion

  1. Issues assigned to Dima:

    • #676: Simplifying FAPI CIBA usage
    • #487: X-FAPI-Interaction-ID implementation guidance
    • #290: X-FAPI-Interaction-ID across client to AS

  2. Issues for Bjorn:

    • #618: Android Carrier OpenID API
    • #620: Security Profile for CAMARA
    • Bjorn to review and respond via email

Vulnerability Disclosure Discussion

  • Joseph Heenan provided comprehensive update on recent vulnerability disclosure
  • Presentation made at IETF OAuth Working Group interim meeting
  • Details shared with relevant open banking ecosystems
  • No known vulnerable implementations identified
  • Discussion ongoing about scope of technical solution
  • Consensus reached on addressing issue through required aud value
  • Decision made not to delay Security BCP publication for this issue
  • Further details available in presentation slides and meeting recording (links shared in chat)

Action Items

  1. Review and approve PR #530, #531, and #529
  2. Dima to review assigned issues (#676, #487, #290)
  3. Bjorn to review and provide updates on issues #618 and #620
  4. Continue monitoring FAPI 2 voting process

Meeting adjourned early with all agenda items covered.

Clone this wiki locally