Skip to content

FAPI_Meeting_Notes_2026 01 28_Atlantic

Jump to bottom
Nat Sakimura edited this page Jul 10, 2026 · 1 revision

FAPI Working Group Meeting Notes

  • Date: 2026-01-28
  • Time: 14:00 UTC
  • Location: Zoom

Attendees

Present

  • Nat Sakimura (Chair)
  • Dave Tonge (Co-chair, absent)
  • Mike Leszcz (OIDF)
  • Imran Ulghar (Open Banking Limited)
  • Christopher Robbertse (Open Banking Limited)
  • Hideki Ikeda (Authlete)
  • Kosuke Koiwai (KDDI)
  • Matthew Murphy (Mastercard)
  • George Fletcher (Practical Identity)
  • Annette Foster (Open Banking Limited)
  • Lukasz Jaromin (Raidiam)
  • Peter Stanley (Open Banking Limited)
  • Robert Gallagher (Mastercard)

Administrative Items

NoteWell and IPR Policy

  • Mike Leszcz presented the standard NoteWell and Trust Policy notices
  • All policies referenced in NoteWell can be found at https://openid.net/policies

Agenda Adoption

  • Draft agenda re-circulated 70 minutes before the meeting
  • Agenda adopted as presented with no additions

Agenda

  1. Roll Call (Nat)
  2. Adoption of Agenda (Nat)
  3. Events (Mike L.)
  4. External Orgs & Liaisons (Mike L.)
  5. PRs (Nat)
  6. Issues (Nat)
    • 6.1 #648 Define requirements for OpenAPI FAPI securityScheme type
  7. AOB (Nat)

Events Update (Mike Leszcz)

Calendar Updates

  • All Q1 through Q3 2026 events have been added to OIDF Google Calendar
  • Events are listed on the OIDF website under Calendar
  • Board members have internal meetings Q1-Q3 on their personal calendars
  • Q4 meetings and industry events will be added to calendars this week
  • Cross-referencing with Heather Flanagan's event list for completeness

Upcoming Events (Q1-Q3 2026)

  • February 2 - FIDO Paris Seminar - Paris
  • February 3 - FIDO Alliance Member Plenary - Paris
  • February 9-12 - TIIME Unconference - Amsterdam
  • March 9-13 - ISO/IEC JTC 1/SC 27 WG Meeting - Nürnberg, Germany
  • March 14-20 - IETF 125 - Shenzhen, China
  • March 16-17 - ISO/IEC JTC 1/SC 27 Plenary - Nürnberg, Germany
  • March 16-19 - FDX Global Summit 2026 - Washington, DC
  • April 27 - OIDF Workshop prior to IIW Spring 2026 - Mountain View
  • April 28-30 - IIW Spring 2026 - Mountain View
  • May 12-15 - ID4Africa - Abidjan
  • May 19-22 - EIC 2026 - Berlin
  • May 27-29 - OAuth Security Workshop (OSW) - Leipzig, Germany
  • June 2 - FIDO Authenticate APAC 2026 - Singapore
  • June 15-18 - Identiverse - Las Vegas
  • June 22-24 - Dice 2026 - Copenhagen
  • July 18-24 - IETF 126 - Vienna
  • September 1-3 - Global Digital Collaboration Conference 2026 - Geneva
  • September 14-17 - ISO/IEC JTC1/SC 17 Plenary - Chengdu, China

Note: Please send any 2026 events to be added to the calendar to mike.leszcz@oidf.org

Ecosystem Engagement Update (Mike Leszcz)

Chile/CMF

  • Regulation Timeline: CMF plans to have regulation in place by August 2026
  • Implementation: Anticipate a few FAPI2 certifications in 2026
  • Ecosystem Launch: Full ecosystem expected to go live in earnest in early 2027
  • Implementation Partner: Minsait is CMF's implementation partner and may join the Foundation in place of CMF to provide directed funding
  • Membership Status: As of week of January 19th, Minsait confirmed membership is in process to provide directed funding
  • Follow-up Activity: Domingos and Mike L had follow-up call week of January 19th to address questions regarding the CMF FAPI Profile
  • Shared Signals: CMF is now considering adopting Shared Signals
  • Next Steps: Next call to include a Shared Signals Working Group co-chair and Thomas from the certification team

UAE

  • Current Status: UAE originally adopted FAPI2 Implementer's Draft to go live prior to final
  • Transition Planning: Domingos and Mike L had follow-up call week of January 19th with UAE and Ozone (implementation partner) to address transition from FAPI2 ID to FAPI2 Final
  • Impact Assessment: Minimal impact on ecosystem partners (primarily TTPs) as well as conformance tests
  • Communication Strategy: UAE and Ozone believe the heavy lift is communicating to the TTPs and are coordinating those efforts currently
  • Timeline: Transition anticipated for Q2 2026

Peru

  • Implementation Partner: PMA (Peruvian Monetary Authority) is adopting FAPI2 as part of Peru's Open Banking initiative
  • Partnership: Peru has partnered with Minsait, who is also supporting CMF in Chile
  • Benefits: This creates opportunities for interoperability and knowledge transfer between ecosystems
  • Profile Development: PMA is working on definition of the FAPI2 profile
  • Technical Support: Domingos and others have provided significant input to date
  • Next Steps: PMA will share draft profile soon for review and comments

Member Reminders (Mike Leszcz)

Vote Announcements

Public Review Period

  • Specification: Proposed OpenID Connect Relying Party Metadata Choices 1.0 Final Specification
  • Review Started: Friday, January 9, 2026
  • Voting Start: Scheduled for Wednesday, March 11, 2026

Note: Mike Leszcz dropped from the call after this section to attend another meeting.

Pull Requests Review

The following pull requests were reviewed:

PR #560 add key management section (Implementation Advice)

PR #540 advice on dpop vs mtls (Implementation Advice)

PR #541 add clause on the AS rejecting nonce or state

PR #561 FAPI 1 Part 2: issue 848

PR #545 security consideration added (to account for JARM Downgrade Attack)(Implementation Advice)

  • Link: https://bitbucket.org/openid/fapi/pull-requests/545
  • Extensive discussion conducted.
  • It was pointed out by several people that "SHOULD reject the response" is inappropriate as it is a MUST in the underlying spec.
  • At the same time, it was also pointed out that a normative requirement (=MUST and MUST NOT) is not appropriate in the advice document, and it was argued that it should not be added to the document.
  • Tending to take the latter view.

PR #529 Note strict validation of audience (as per ciba)

Issues Discussion

Issue #648: Define requirements for OpenAPI FAPI securityScheme type

  • Link: https://github.com/openid/fapi/issues/648
  • Substantial discussion conducted.
  • It was pointed out that as it stands, it is not possible to express FAPI in OpenAPI 3.2.
  • Some participant argued that it is not in the scope of the FAPI WG and the WG lacks the expertise, while about the equal number of participant argued that it is often needed and FAPI WG is the most appropriate body to advocate for the extension of the OpenAPI.
  • Since it would involve the toolings, it was agreed that it should get into the core, if it was to be done.
  • The topic is to be discussed in the subsequent calls.

Issue #837: FAPI2 Security Profile - ISO/IEC 26083-1

  • Link: https://github.com/openid/fapi/issues/837
  • Type: ISO/IEC JTC1 Pass comments
  • Category: Newly submitted issue
  • Nature: General and editorial updates on security profile
  • Source: Collection of issues from ISO review process
  • Classification: Marcus designated whether issues apply to Pass only or should be addressed as root items
  • All issues are editorial in nature
  • Action Items:
    • Working group members requested to review and comment as needed
    • Nat to take up again next week and bring back to Pacific call where Mark will be present
    • Goal to resolve in timely fashion

Issue #838: FAPI2 Attacker Model - ISO/IEC 26083-2

  • Link: https://github.com/openid/fapi/issues/838
  • Type: ISO/IEC JTC1 Pass comments
  • Category: Newly submitted issue
  • Nature: Collection of issues on the Attacker Model
  • Classification: Marcus designated whether issues apply to Pass only or should be addressed as root items
  • All issues are editorial in nature
  • Action Items:
    • Working group members requested to review and comment as needed
    • Nat to take up again next week and bring back to Pacific call where Mark will be present
    • Goal to resolve in timely fashion

Issue #595: Create a resource server profile on top of FAPI 2

  • Link: https://github.com/openid/fapi/issues/595
  • Previous Discussion: Discussed in Pacific call last week
  • Current Status: Upon Mark and Dima to bring to Ecosystem Working Group
  • Next Meeting: Ecosystem Working Group meeting scheduled for Friday (or similar timeframe)
  • Action Items:
    • Mark and Dima to present to Ecosystem Working Group and gather feedback
    • Working group members encouraged to leave comments on the ticket if they have insights

Issue #404: Interoperability validation

Issue #835 (Follow-up from previous week)

  • Raised by: Robert Gallagher (Mastercard)
  • Context: Agreement reached in previous week's working group meeting
  • Current Status: Passed over to Joseph (certification team)
  • Question: How to track progress on certification team tickets
  • Nat's Response:
    • Issue should be tracked in Certification team ticket system
    • Nat hasn't had chance to talk to Joseph yet
    • Will follow up with Joseph
  • Action Items:
    • Nat to contact Joseph
    • Robert also encouraged to try to get hold of Joseph

Any Other Business

  • No additional business items were declared
  • Items deferred to next week's discussion as needed

Next Meeting

  • Date: Same time next week (February 4, 2026)
  • Nat expressed looking forward to meeting everyone again

Meeting Adjourned

  • Meeting concluded at approximately 52 minutes into the call
  • Thanks expressed for constructive discussion

Action Items Summary

  1. Mike Leszcz:

    • Add Q4 2026 meetings and industry events to calendars this week
    • Cross-reference with Heather Flanagan's event list

  2. Chile/CMF:

    • Schedule follow-up call including Shared Signals WG co-chair and Thomas (certification team) to discuss Shared Signals adoption

  3. Peru:

    • Await draft FAPI2 profile from PMA for review and comments

  4. Issue #837 & #838:

    • All working group members to review ISO Pass comments and provide feedback
    • Nat to bring issues back to Pacific call next week with Mark present

  5. Issue #595:

    • Mark and Dima to present resource server profile to Ecosystem Working Group
    • Working group members to leave comments on ticket if they have insights

  6. Issue #404:

    • Nat to ping Lukasz Jaromin offline for update

  7. Issue #835:

    • Nat to contact Joseph regarding certification team tracking
    • Robert Gallagher to also try contacting Joseph

Reference Links

Pull Requests

Issues

Other References

Clone this wiki locally