-
Notifications
You must be signed in to change notification settings - Fork 0
FAPI_Meeting_Notes_2026 06 24_Atlantic
Date: 2026-06-24
Time: 14:00 UTC
Location: Zoom
Chair: Nat Sakimura (NAT.Consulting / Authlete)
| Name | Organisation |
|---|---|
| Nat Sakimura (Chair) | NAT.Consulting / Authlete |
| Mike Leszcz | OIDF |
| Imran Ulghar | Open Banking Limited (OBL) |
| Christopher Robbertse | Open Banking Limited (OBL) |
| George Fletcher | Practical Identity |
| Robert Gallagher | Mastercard |
| Kosuke Koiwai | KDDI |
| Filip Skokan | Okta |
| Chris Wood | Ozone API |
The OpenID Foundation Note Well applies to all contributions made during this call.
The agenda was adopted with one addition proposed by Mike Leszcz: a brief discussion of the Bitbucket-to-GitHub repository migration, to be inserted after item 3 (External Orgs & Liaisons).
Final agenda:
- Roll Call
- Adoption of Agenda
- Events 3a. GitHub Migration (added)
- External Orgs & Liaisons
- PRs
- Issues
- AOB
Dave Tonge was absent; Nat Sakimura chaired.
Reported by Mike Leszcz.
The following events were noted. Members were encouraged to send any additional 2026 events to mike.leszcz@oidf.org.
| Date | Event | Location |
|---|---|---|
| 22–24 June 2026 | DICE 2026 | Copenhagen |
| 18–24 July 2026 | IETF 126 | Vienna |
| 26 August 2026 | OIDF-J OpenID Summit 2026 Special Edition | Tokyo |
| 1–3 September 2026 | Global Digital Collaboration Conference 2026 | Geneva |
| 14–17 September 2026 | ISO/IEC JTC1/SC 17 Plenary | Chengdu, China |
| 19–21 October 2026 | FIDO Authenticate 2026 | Carlsbad, CA |
| 2 November 2026 | OIDF Workshop (prior to IIW Fall) | Mountain View |
| 3–5 November 2026 | IIW Fall 2026 | Mountain View |
| 14–20 November 2026 | IETF 127 | San Francisco |
| 7–9 December 2026 | Gartner IAM US | Las Vegas |
| 2–4 February 2027 | OIDF Global Conference 2027 (Save the Date) | London |
Mike highlighted several items:
- Colleagues are attending DICE 2026 in Copenhagen through the meeting date.
- The working group will need to decide whether to hold its regular call during IETF 126 week (18–24 July), depending on attendee availability.
- The OIDF Workshop prior to IIW Fall (Monday, 2 November) follows the Foundation's traditional format. Registration details will be shared on a future call.
- The 2027 OIDF Global Conference in London (2–4 February) is the Foundation's first annual global conference. It will include one full conference day plus adjacent working group and other meetings. The conference page will be updated regularly: https://openid.net/conference/
Nat asked whether there were any notable updates from Identiverse (held the previous week). No substantive updates were raised from the floor.
Reported by Mike Leszcz.
Domingos has successfully completed the Bitbucket-to-GitHub migration for all other active working groups; the eKYC-IDA WG migration was completed the previous day (23 June). FAPI is the last active working group yet to be migrated.
Blocking issue: PR 529 (CIBA-related, open since 9 January 2025) is the sole outstanding open merge request on Bitbucket. Pull requests do not migrate to GitHub automatically.
Two options were presented to the working group:
- Close PR 529 first, then proceed with migration once no open PRs remain.
- Migrate immediately, accepting that PR 529 will not carry over; it can be recreated on GitHub post-migration by a co-chair or contributor.
After discussion, Nat proposed merging PR 529 as-is, noting that the outstanding comments are editorial in nature. The plan would be to merge it now, proceed with migration, and open a new PR on GitHub to address the editorial items afterward. No objections were raised; the group agreed to proceed on this basis.
Migration logistics:
- The migration is expected to take a maximum of two business days.
- Domingos will send a notification to the mailing list confirming the start date and anticipated completion date. During the migration window, contributors should refrain from filing or updating issues and PRs in Bitbucket.
- A follow-up notification to the mailing list and co-chairs will be sent once migration is complete.
- Action: Nat will collect GitHub handles from active contributors. Contributors are asked to send their GitHub handle to Nat via Slack.
Reported by Mike Leszcz.
Joseph Heenan and Domingos met with Brazilian Government (Interior Department) officials in Brasilia while colleagues attended Identiverse. The introductory meeting was very positive. Next steps:
- A follow-up technical call is being coordinated to provide a deeper dive into OpenID specifications.
- The Brazilian government has expressed strong interest in both adopting OpenID specifications and pursuing conformance and certification.
- An ecosystem outreach workshop (following the Foundation's standard model for new adopters) is anticipated once the technical engagement matures.
Joseph also travelled to São Paulo to meet with Open Finance Brazil partners, including Elcio Calefi and Paulo. A key topic was OFB's adoption of CIBA, which is anticipated to begin by end of 2026.
Domingos has been working on the updated KSA FAPI 2 profile implementation and is currently testing it with Ozone. There is a known issue under investigation before testing can proceed further.
Domingos has implemented the first test with Grant Management on FAPI 2. Work is underway with Minsait (CMF's implementation partner) to update the testing implementation. Once the Grant Management tests are confirmed, DCR tests will be addressed as a second step.
Nat noted that Grant Management is an area the working group should continue to watch, observing that Chile is actively adopting it.
- Link: https://bitbucket.org/openid/fapi/pull-requests/529
- Open since 9 January 2025.
- As discussed under agenda item 3a, Nat proposed merging PR 529 given that remaining comments are editorial. A new PR will be opened on GitHub post-migration to address those editorial items.
- No objections were raised. The proposal was adopted.
Dave Tonge (co-chair) was absent, and Nat noted he had not yet had the opportunity to review the pending issue backlog with Dave and Dima, as SC27 Working Group 5 meetings had made the week busy. Issue triage will resume once the GitHub migration is complete.
- Link: https://github.com/openid/fapi/issues/838
- Nat reported that he had a call with Mark on Monday (22 June) regarding ISO/IEC 26083-2. Mark indicated he is nearly done with his work and will be acting on it shortly. Nat will keep the group posted.
Imran Ulghar raised the question of OIDF's ongoing AI-related activities and whether members could participate. Nat confirmed that an AI-related subcommittee is expected to be formed later in June or early July 2026. Notification will go out to the member mailing list once dates are confirmed. Mike Leszcz noted that an AI Community Group already exists within OIDF and offered to direct interested parties to the relevant resources. Mike shared his email (mike.leszcz@oidf.org) in chat for follow-up.
George Fletcher raised a question from a side conversation at Identiverse: are there any known deployments of FAPI protecting MCP server endpoints or other AI-related API endpoints? He noted the broader question of whether MCP represents a durable pattern or merely a transitional gateway model for AI resource invocation.
Nat suggested creating an issue on the tracker to follow up. George agreed to wait until after the GitHub migration before filing the issue, anticipating that would be by end of the following week at the latest. Mike confirmed this approach would be cleanest. George noted the topic may also be suitable for the AI Identity Management Community Group and would likely be relevant to the Foundation's architecture committee work.
Nat drew attention to US Executive Order 14409, "Securing the Nation Against Advanced Cryptographic Attacks," which was signed on Monday (22 June 2026). The order concerns PQC migration. Nat flagged this for members who may not have it on their radar.
| # | Action | Owner | Due |
|---|---|---|---|
| 1 | Merge PR 529; open follow-up editorial PR on GitHub post-migration | Nat | Before migration |
| 2 | Collect GitHub handles from active contributors and provide to Domingos | Nat | Before migration |
| 3 | Active contributors to send GitHub handles to Nat via Slack | All active contributors | ASAP |
| 4 | Domingos to notify mailing list of migration start/end dates and freeze period | Domingos (coord. Mike) | This week / beginning of next week |
| 5 | George Fletcher to file a GitHub issue on FAPI + MCP / AI endpoint usage after migration | George Fletcher | After migration (≈ end of next week) |
| 6 | Mike to direct Imran to OIDF AI Community Group resources | Mike Leszcz | Offline |
| Reference | URL |
|---|---|
| PR 529 (Bitbucket) | https://bitbucket.org/openid/fapi/pull-requests/529 |
| Issue 850 — FAPI 2 Attacker Model / ISO-IEC 26083-2 | https://github.com/openid/fapi/issues/838 |
| 2027 OIDF Global Conference | https://openid.net/conference/ |
| US EO 14409 (PQC) | https://www.whitehouse.gov (search EO 14409) |
Next Atlantic call: 1 July 2026 (subject to confirmation). The group should anticipate that GitHub migration may begin or complete around this time; Domingos will notify the list of precise dates.
Notes prepared from transcript and chat log.