Skip to content

FAPI_Meeting_Notes_2026‐09‐30_Atlantic

Jump to bottom
Nat Sakimura edited this page Oct 1, 2026 · 1 revision

FAPI Working Group — Atlantic Call

Date: 2026-09-30

Time: 14:00 UTC

Location: Zoom

Chair: Nat Sakimura (NAT.Consulting / Authlete)

Co-Chair: Dave Tonge (Moneyhub), Dima Postonikov, Anoop Saxana — absent

1. Attendees

Name Affiliation
Nat Sakimura NAT.Consulting / Authlete
Mike Leszcz OpenID Foundation (OIDF)
Elizabeth Garber OpenID Foundation (OIDF) — joined late, for the conference item
Peter Stanley Open Banking Limited (OBL)
Chris Robbertse Open Banking Limited (OBL)
Matthew Murphy Mastercard
Robert Gallagher Mastercard
Hideki Ikeda Authlete
George Fletcher Practical Identity
Łukasz Jaromin

Attendance was light because ISO/IEC JTC 1/SC 27 working group meetings were running in parallel this week, and Co-Chair Dave Tonge was unavailable.

2. Agenda

  1. Roll Call (Dave/Nat)
  2. Adoption of Agenda (Dave/Nat)
  3. Events (Mike L.)
  4. External Orgs & Liaisons (Mike L.)
  5. PRs (Dave)
  6. Issues (Dave)
  7. AOB (Nat)

3. Pre-meeting Discussion

Before the call opened, Robert Gallagher thanked Nat Sakimura for his comments on the EMVCo paper, which was due for submission that day (2026-09-30). Nat expressed the hope that this would be a first step towards closer collaboration between EMVCo and the OpenID Foundation through the liaison arrangement. Robert observed that much of EMVCo's current work builds on OIDF specifications, and noted from another OIDF call that work such as SD-JWT is driven largely by OIDF participants. Nat added that OIDF often acts as an early R&D venue for work later standardised at the IETF (e.g., JWT and JWS), and that early feedback from EMVCo would be valuable, with OIDF potentially contributing to EMVCo's work in return. Robert agreed to pursue this from his side.

4. Note Well

Mike Leszcz presented the OpenID Foundation Note Well, referencing the Code of Conduct Policy, and the Note Really Well, referencing the antitrust policy and the requirement for a signed contribution agreement to participate in working groups. All referenced policies are available at https://openid.net/policies.

5. Roll Call and Adoption of Agenda

Participants were asked to record their names in the chat. No additions to the draft agenda were proposed, and it was adopted as circulated.

6. Events

Mike Leszcz posted the events list to the chat and highlighted the following:

  • OIDF Workshop (2026-11-02, Sunnyvale): The Foundation will hold its customary workshop ahead of IIW, hosted by CrowdStrike. Registration is open, and the event is hybrid, so remote participation is possible.
  • Finance of Tomorrow (Rio de Janeiro): Originally scheduled for 2026-11-17/18, this has been moved to spring 2027, likely March, and will be removed from the 2026 calendar.
  • 2027 OIDF Global Conference (London): The main conference is on 2027-02-02, with adjacent events and meetings on 2027-02-03 and 2027-02-04. The Call for Proposals is open.
  • 2027 calendar: Mike is compiling the 2027 events calendar now and asked participants to send any 2027 events to mike.leszcz@oidf.org. He expects to present an updated calendar covering at least Q1, and possibly H1, 2027 on next week's call, after reviewing it with the Executive Committee later this week.

Full list as posted in chat:

Nat Sakimura added that, as announced in the AB/Connect Working Group the previous day, W3C TPAC 2026 will take place 2026-10-26 to 2026-10-30 in Dublin (https://www.w3.org/news-events/tpac/2026/). Registration appears to be open to non-W3C members. Mike will add it to the OIDF internal calendars.

Member reminder (posted in chat): The final call to vote to approve the proposed OpenID Connect Ephemeral Subject Identifier 1.0 Final Specification is open through 2026-09-30: https://openid.net/foundation/members/polls/424

7. External Orgs & Liaisons

Mike Leszcz reported no material ecosystem updates this week. As mentioned on the previous call, OIDF has had a productive recent call with Peru, which is targeting go-live in 2027 and remains on track. No other participants had updates.

8. Pull Requests

PR #870 — Grant Management

Nat Sakimura reported that PR #870 on Grant Management has received approval but is still awaiting review from Torsten Lodderstedt, who was requested as a reviewer. Torsten is heavily occupied with the German wallet rollout, so his review may not be forthcoming. The change is limited to renaming the last_updated field to last_updated_at. Nat asked any participant able to review and approve the PR to do so.

The remaining PRs are Dave Tonge's, so they were deferred to next week in the hope that Dave can attend.

9. Issues

Issue #871 — Versioned FAPI 2.0 Implementation and Deployment Advice

Nat Sakimura created issue #871 just before the call. An ecosystem rolling out FAPI 2.0 (not named, as Nat was unsure whether he was permitted to disclose it) has asked the co-chairs to produce a versioned copy of the FAPI 2.0 Implementation and Deployment Advice document.

Nat noted that implementation advice documents tend to be living documents that are updated from time to time, which may not fit the normal publication route well, though the WG could continue to publish Implementer's Drafts as well.

Peter Stanley offered his personal view (as opinion rather than recommendation) that organisations implementing within an ecosystem prefer versioned documents because they give implementers and other ecosystem bodies a stable reference. If multiple organisations point to an unversioned document that changes, they may end up implementing differently with no reliable way to determine why or when divergence occurred. In his view, versioned documents are very useful and should be supported where possible.

Nat agreed and said this was also his reading of the request, adding that the WG should act on it fairly soon. The appropriate publication vehicle is still to be determined.

Outcome: No objections were raised on the call. The default position is to create a versioned Implementation and Deployment Advice document. Nat will confirm this on the mailing list.

Issue #733 — JARM Downgrade

Nat Sakimura recapped the issue, which concerns the Implementation and Deployment Advice document. The WG last discussed it in March 2026, when it agreed that an implementation advice document cannot introduce normative requirements and asked the original submitter, Yaron, whether that would be acceptable. Yaron Zehavi responded that the downgrade attack is real and must be addressed.

Łukasz Jaromin had subsequently proposed the following wording, which Yaron has indicated is acceptable to him:

"A client SHOULD reject the response if it requests a JARM response from an authorization server that advertises JARM support in its response_modes_supported metadata attribute but receives a response that is not JARM-compliant."

After checking the current Implementation and Deployment Advice document, Nat proposed creating a new section on the JARM downgrade attack containing Łukasz's sentence.

Outcome: No objections were raised. Nat will record the decision in the issue.

Open call for issues

Nat asked whether participants wished to pick up any other issues. None were raised. Nat noted that he was less prepared than usual owing to the concurrent ISO meetings.

10. 2027 OIDF Global Conference — FAPI WG Participation

(Taken during the Issues item, when Elizabeth Garber joined.)

Elizabeth Garber followed up on her visit to the WG two or three weeks earlier. The conference organisers are working out which working groups will be present in person in London on 2027-02-02 to 2027-02-04. Engagement is already confirmed from Brazilian open banking, and other open data ecosystems, potentially including the UK, are expected. Meeting rooms are available for working groups, and the organisers can also help arrange demonstrations or other activities.

Nat Sakimura said that, given the FAPI WG's close collaboration with UK Open Banking and the number of participants based in London, an in-person FAPI WG meeting would make sense at a minimum. He assumed there would also be an open banking/open data session in the main conference programme. Elizabeth confirmed that she expects one, possibly a panel on open banking and open data, and asked participants to propose sessions and connect her with suitable speakers.

Nat asked whether the FAPI WG should itself propose a session, such as a panel, or whether one was already planned by the organisers. Elizabeth said a FAPI WG proposal would be very welcome. Given the WG's experience with many mature real-world implementations, she suggested the committee would be open to a "lessons learned" keynote or main-stage panel in addition to working group time. Nat cautioned that main-stage time is limited and overlapping sessions should be avoided. Elizabeth said the programme is still taking shape and invited the WG's thoughts.

Suggestions from participants:

  • Peter Stanley: Open Banking Limited intends to engage with the conference and will contact Elizabeth if it has not already. As a WG topic, he suggested "the road from FAPI 1 to FAPI 2", covering why FAPI 2.0 rather than FAPI 1, what FAPI 2.0 brings to ecosystems, and what problems it addresses. He noted that the UK uses FAPI 1 and will be hard to move off it for some time, so a talk making the case for migration would help tell that story, and the WG includes many people directly involved in developing the standard.
  • George Fletcher: In response to Nat's suggestion, he agreed that FAPI for agentic payments / agentic commerce could be a compelling topic (George has an existing tracking issue #849 on this). He saw two possible angles: how FAPI is being used in such flows today, if at all, or, absent deployment data, how FAPI could benefit these flows and where risks exist in currently proposed mechanisms and protocols. He was not aware of anyone yet doing this work. Nat expressed strong interest in this direction.
  • Peter Stanley: Given the light attendance, the question should be asked again when the usual participants are present.

Nat agreed and said he would also raise the question on the mailing list to encourage offline discussion, as the call time does not suit all regions (e.g., about 2 AM in Australia). He will also create a GitHub task, possibly with a deadline, to track the conference proposal. Elizabeth asked participants who attend other OIDF working group calls to raise the same question there.

11. AOB

Nat Sakimura may be unable to host next week's call (2026-10-07) because of the ISO/IEC JTC 1/SC 27 plenary, where he must represent Japan as head of delegation holding the sole vote. He will ask the other co-chairs whether they can host. If not, the call may be cancelled.

The call was then closed.

12. Action Items

# Action Owner
1 Review and approve PR #870 (Grant Management: last_updated → last_updated_at) Any WG participant
2 Bring remaining PRs to next call Dave Tonge
3 Confirm on the mailing list the default position to publish a versioned FAPI 2.0 Implementation and Deployment Advice document (issue #871); determine the publication vehicle Nat Sakimura
4 Record in issue #733 the decision to add a JARM downgrade attack section using Łukasz Jaromin's proposed sentence Nat Sakimura
5 Create a GitHub task (with a deadline) to track FAPI WG participation and session proposals for the 2027 OIDF Global Conference Nat Sakimura
6 Raise the conference-session question (e.g., "Road from FAPI 1 to FAPI 2", FAPI for agentic commerce) on the mailing list and on a future call with fuller attendance Nat Sakimura
7 Contact Elizabeth Garber regarding OBL engagement with the 2027 OIDF Global Conference Open Banking Limited (via Peter Stanley)
8 Add W3C TPAC 2026 to OIDF internal calendars; present updated 2027 events calendar next week Mike Leszcz
9 Send any 2027 events for the OIDF calendar to mike.leszcz@oidf.org All participants
10 Ask other co-chairs to host the 2026-10-07 call; otherwise cancel Nat Sakimura
11 Pursue closer EMVCo–OIDF collaboration through the liaison arrangement Robert Gallagher

13. References

Item Link
PR #870 — Grant Management https://github.com/openid/fapi/pull/870
Issue #871 — Versioned Implementation and Deployment Advice https://github.com/openid/fapi/issues/871
Issue #733 — JARM Downgrade https://github.com/openid/fapi/issues/733
OIDF Policies (Note Well) https://openid.net/policies
OIDF Hybrid Workshop registration (2026-11-02) https://openid.net/registration-open-for-openid-foundation-hybrid-workshop-on-mon-2nd-nov-2026/
2027 OIDF Global Conference https://openid.net/conference/
2027 Conference Call for Proposals https://openid.net/oidf2027conference_call-for-proposals/
W3C TPAC 2026 https://www.w3.org/news-events/tpac/2026/
Ephemeral Subject Identifier 1.0 Final — member vote https://openid.net/foundation/members/polls/424

Clone this wiki locally