Repository navigation
FAPI_Meeting_Notes_2026 08 19_Atlantic
Date: 2026-08-19
Time: 14:00 UTC
Location: Zoom
Chair: Nat Sakimura (NAT.Consulting / Authlete)
Co-Chair: Dave Tonge (Moneyhub) — not present
| Participant | Affiliation |
|---|---|
| Nat Sakimura | NAT.Consulting / Authlete (Chair) |
| Mike Leszcz | OpenID Foundation (OIDF) |
| Joseph Heenan | OIDF / Authlete |
| Hideki Ikeda | Authlete |
| Kosuke Koiwai | KDDI |
| Matthew Murphy | Mastercard |
| Christopher Robbertse | Open Banking Limited (OBL) |
| Ashmita Chakraborty | Individual contributor |
Notes on attendance:
- Christopher Robbertse did not enter a name in the roll-call chat but participated verbally and announced his departure at ~00:36 elapsed.
- Ashmita Chakraborty dropped at ~00:23, Mike Leszcz at ~00:28, Matthew Murphy at ~00:29.
- The Chair observed at ~00:39 that the call had effectively lost quorum; remaining business was handled as informational.
- Dima Postnikov was noted as absent during the grant management discussion; the Chair undertook to follow up with him directly.
The Note Well was presented by Mike Leszcz, covering the Code of Conduct, the antitrust policy, and the requirement for a signed contribution agreement to participate in OIDF working groups. All referenced policies are published at https://openid.net/policies/.
The Chair asked whether a recorded version of the Note Well could be produced. Mike Leszcz confirmed the item sits on the marketing team's backlog, and committed to recording it and embedding it in the standard slide deck for distribution to co-chairs, subject to the current holiday period. The Chair offered to assist if useful.
The draft agenda was posted to chat and adopted without amendment. No additional items were requested from the floor.
- Roll Call (Dave/Nat)
- Adoption of Agenda (Dave/Nat)
- Events (Mike L.)
- External Orgs & Liaisons (Mike L.)
- PRs (Dave)
- Issues (Dave)
- AOB (Nat)
Mike Leszcz gave a brief update and posted the full events list to chat.
Upcoming events
| Date | Event | Location |
|---|---|---|
| 2026-08-26 | OIDF-J OpenID Summit 2026 Special Edition | Tokyo |
| 2026-09-01 – 2026-09-03 | Global Digital Collaboration Conference 2026 | Geneva |
| 2026-09-14 – 2026-09-17 | ISO/IEC JTC 1/SC 17 Plenary | Chengdu, China |
| 2026-10-19 – 2026-10-21 | FIDO Authenticate 2026 | Carlsbad, CA |
| 2026-11-02 | OIDF Workshop prior to IIW Fall 2026 | Mountain View |
| 2026-11-03 – 2026-11-05 | IIW Fall 2026 | Mountain View |
| 2026-11-14 – 2026-11-20 | IETF 127 | San Francisco |
| 2026-12-07 – 2026-12-09 | Gartner IAM US | Las Vegas |
| 2027-02-02 – 2027-02-04 | 2027 OIDF Global Conference (save the date) | London |
Highlights called out on the call:
- DCP and DCHP working group meetings will be held on Monday 2026-08-31 in Geneva, immediately preceding the Global Digital Collaboration Conference. Logistics are circulated on the respective working group mailing lists.
- The traditional OIDF workshop preceding IIW will take place on Monday 2026-11-02. The host location is not yet confirmed; a blog post with details will follow once it is.
- The content committee for the 2027 OIDF Global Conference in London is actively meeting, so updates to the conference page are anticipated in the coming weeks. Members were asked to hold the dates.
- Work has begun on the internal and external 2027 events calendar. Members with events to be listed should send them to mike.leszcz@oidf.org.
OIDF presence at GDC 2026 (Geneva). Confirmed OIDF staff attendance comprises Mike Leszcz, Gail Hodges, Joseph Heenan and Elizabeth. Mike Leszcz will arrive early to support the two working group meetings on the Monday. The OpenID Foundation certification team will meet in Geneva on the Friday and Saturday following the conference. The Chair will also attend. The Chair concluded that the Foundation is well covered for the event.
Member reminders. Two specification polls are open or opening shortly, and members were asked to vote:
- Notice of Vote to Approve Proposed Implementer's Drafts of Two OpenID Federation Extensions — voting opens 2026-08-21.
- Notice of Vote to Approve Proposed Implementer's Draft of OpenID Connect Key Binding — voting opens 2026-08-24.
Saudi Arabia (KSA). Domingos Creado continues work on the FAPI 2.0 KSA profile, working closely with Ozone to complete testing. Once testing is through, the profile can be pushed to production and certification opened.
Chile. Domingos Creado continues close collaboration with the CMF and MinSafe teams in Chile on the development of their FAPI 2.0 tests. Both the KSA and Chile efforts were reported as progressing positively.
OECD. The Chair noted an OECD meeting scheduled in Paris during the same week as IIW Fall 2026. The Chair will not be participating because of the IIW clash, and invited any Europe-based participants who are not travelling to IIW to consider attending. The Chair offered to circulate the dates.
No further liaison items were raised from the floor.
https://github.com/openid/fapi/pull/858
Raised by Joseph Heenan. The Chair characterised the PR as editorial. Joseph Heenan clarified that it is technically normative in one respect — the change to grant_management_actions_supported to state that it is the list of grant management actions — but that the previous text was plainly wrong, so the change corrects an obvious mistake rather than altering intended behaviour. Joseph Heenan noted he had found one genuinely non-editorial problem while reviewing and had raised it as a separate issue rather than folding it into this PR (see Issue #857).
The Chair asked participants to review and approve, after which he will merge.
https://github.com/openid/fapi/pull/855
Raised by Joseph Heenan. The PR touches no specification text. It restores publication of specification previews to GitHub Pages, which had not been addressed as part of the Bitbucket-to-GitHub migration, with the result that no drafts were being published at all. Joseph Heenan went further and added HTML preview publication for pull requests, which the meeting welcomed as a useful upgrade to the editorial workflow.
The Chair will review, and asked others to review and approve in parallel.
https://github.com/openid/fapi/pull/860
Raised by Joseph Heenan during the call, as the resolution to Issue #853 (below). The PR deletes the placeholder files that existed solely to keep legacy Bitbucket links resolving. The Chair reviewed it live, confirmed it appeared to be a straightforward deletion of files that are no longer needed, and said he would record his approval after the call subject to a double-check. Merge will follow once further approvals are in.
https://github.com/openid/fapi/issues/857
Joseph Heenan reported that the Grant Management examples use last_updated_at, while the normative text specifies last_updated. The two other timestamps in the same structure both carry the _at suffix, which suggests the normative text is the error and the example is correct — but he was not certain whether the omission was deliberate.
Discussion points:
- No ecosystem is known to have deployed Grant Management in production yet. Chile is in the process of doing so.
- A conformance test exists but has not yet been published; it may need adjusting depending on the outcome. This was not considered a significant obstacle.
- If the change is made normatively, it strengthens the case for progressing an Implementer's Draft sooner rather than later.
- The Chair observed that if the change is to be made for consistency, this is likely the last opportunity, and it therefore needs to be resolved quickly.
No opinions were offered from the floor. The Chair stated his personal view that the specification should be made consistent, and set out the following process: he will discuss it directly with Dima Postnikov, post the question to the mailing list, and if no objection is heard by the next call, commit to the change.
The issue is a further hangover from the migration away from Bitbucket. Joseph Heenan had incidentally fixed some of the affected links in PR #855, but had not worked through them all, partly because some links will not resolve correctly until that PR is merged, and verification is far easier once they do.
Joseph Heenan proposed that several of the placeholder files could simply be deleted: they existed only to keep old Bitbucket links valid, and that rationale no longer applies now the repository has moved. The Chair framed the decision as a choice between updating the links in those files and removing the files outright. The meeting agreed on a mixed approach:
- Files where the links genuinely need to be current — the README and similar — should be updated.
- Pure placeholder files should be removed.
The Chair recorded the outcome on the ticket during the call. Joseph Heenan subsequently raised PR #860 to carry out the deletions.
https://github.com/openid/fapi/issues/718
An older issue on which no action has been taken. Joseph Heenan confirmed something still needs to be done, and noted that because FAPI CIBA has not been taken to Final, the correction can still be made.
The meeting agreed that FAPI CIBA should be progressed to Final sooner rather than later. Joseph Heenan reported that both ConnectID and Brazil are working to deploy it, and understood Brazil to be going live within a few months.
The Chair recorded the discussion on the ticket and assigned it to himself so that he can raise the corresponding PR.
https://github.com/openid/fapi/issues/848
The Chair asked for an update on the state of the certification tools. Joseph Heenan reported that for FAPI 1 no substantive changes have been made for this issue yet; there is a small possibility that a test was added to warn where the new audience value is not accepted, but this was not confirmed on the call.
The issue needs a dedicated discussion with Peter Stanley (OBL). Christopher Robbertse advised, on Peter Stanley's behalf, that Peter is on leave this week and returns on Tuesday 2026-08-25, so any time after that would work. Taking the GDC week into account, the meeting concluded that the week following GDC is the better option, and tentatively pencilled in Wednesday 2026-09-09. The Chair will post to the mailing list to confirm Peter Stanley's availability.
https://github.com/openid/fapi/issues/693
An old issue, last updated in March of the previous year. The Chair asked how the certification suite currently behaves — whether it raises a hard failure or a warning.
Joseph Heenan checked the suite behaviour during the call and reported that when testing a client, the suite accepts any case, i.e. it performs a case-insensitive comparison; and that when it signs a request object it uses a fixed value containing a mixture of upper- and lower-case characters. He confirmed this is present in FAPI 1, that the behaviour was carried over into the FAPI 2 tests, and that FAPI CIBA is covered as well. On that basis he proposed closing the issue.
The Chair closed the issue during the call with a comment recording that the behaviour is covered in FAPI 1, FAPI 2 and FAPI CIBA.
https://github.com/openid/fapi/issues/845
The issue requests a dedicated call for FAPI CIBA. The Chair agreed that the time to hold it has come, and will coordinate with Dave Tonge to arrange it. He assigned the issue to himself for the time being.
Open FAPI CIBA items noted in the course of the discussion:
- The RAR reference in the specification is out of date.
- An issue remains open on making the limitations of the binding message explicit.
- A new IETF RFC on the security of cross-device flows was published the previous week — RFC 10027, Best Current Practice for cross-device flow security: https://datatracker.ietf.org/doc/rfc10027/
Joseph Heenan offered to raise an issue proposing that a reference to the new BCP be added, and did so during the call as Issue #859 (https://github.com/openid/fapi/issues/859).
https://github.com/openid/fapi/issues/738
Joseph Heenan reported that Domingos Creado has chased the UAE again. The most recent record he could locate was from 2026-06-10, when Domingos Creado reported that he had communicated with them both in writing and on a call, but had received no feedback. The issue therefore cannot yet be closed.
Joseph Heenan noted that Łukasz Jaromin (Raidiam) had indicated he believed the relevant items were still in use, and may hold more accurate information than the working group does. He suggested seeking an update from Łukasz Jaromin the next time he joins a call, and offered to message him separately in the meantime.
The Chair asked whether the issue should be assigned to Domingos Creado. Joseph Heenan agreed this was the best available option, and the Chair noted the assignment can be changed later if needed.
Cryptographic transition. The Chair noted that a number of items relating to the cryptographic transition (post-quantum readiness) remain to be discussed. Given that quorum had been lost, he decided against opening them on this call and will instead announce them in advance of a future call so that interested participants can plan to attend.
PR #860. Joseph Heenan announced PR #860 (covered under section 5) and asked participants to review it.
No further business was raised, and the call closed early.
| # | Action | Owner | Target |
|---|---|---|---|
| 1 | Record the Note Well, embed it in the standard slide deck, and distribute to co-chairs | Mike Leszcz | After the holiday period |
| 2 | Send any 2027 events for the OIDF calendar to mike.leszcz@oidf.org | All members | Ongoing |
| 3 | Vote in the two open specification polls (Federation Extensions; OpenID Connect Key Binding) | All members | From 2026-08-21 / 2026-08-24 |
| 4 | Circulate the OECD Paris meeting dates for Europe-based participants not attending IIW | Nat Sakimura | — |
| 5 | Review and approve PR #858 (Grant Management editorial corrections); merge once approved | WG participants / Nat Sakimura | Before next call |
| 6 | Review and approve PR #855 (GitHub Pages draft and PR previews); merge once approved | WG participants / Nat Sakimura | Before next call |
| 7 | Record review of PR #860 (remove Bitbucket placeholder files) and merge once further approvals are in | Nat Sakimura | After 2026-08-19 |
| 8 | Discuss Issue #857 timestamp naming directly with Dima Postnikov | Nat Sakimura | Before next call |
| 9 | Post Issue #857 to the mailing list; commit to the consistency change if no objection by the next call | Nat Sakimura | 2026-08-26 |
| 10 | Update links in README and similar files; remove residual Bitbucket placeholder files (Issue #853) | Joseph Heenan | PR #860 raised |
| 11 | Raise a PR resolving Issue #718 (FAPI CIBA) | Nat Sakimura | — |
| 12 | Post to the mailing list to confirm Peter Stanley's availability for a dedicated Issue #848 discussion, tentatively 2026-09-09 | Nat Sakimura | Before 2026-09-09 |
| 13 | Coordinate with Dave Tonge to schedule the dedicated FAPI CIBA call (Issue #845) | Nat Sakimura | — |
| 14 | Progress Issue #859 — add a reference to RFC 10027 in FAPI CIBA | Joseph Heenan | — |
| 15 | Message Łukasz Jaromin for an update on continued use, and seek an update on his next call attendance (Issue #738) | Joseph Heenan | — |
| 16 | Keep Issue #738 assigned to Domingos Creado pending UAE feedback | Nat Sakimura / Domingos Creado | — |
| 17 | Announce the cryptographic transition agenda items in advance of a future call | Nat Sakimura | Before the relevant call |
| Reference | Link |
|---|---|
| PR #858 — Grant Management editorial corrections | https://github.com/openid/fapi/pull/858 |
| PR #855 — GitHub Pages draft and PR previews | https://github.com/openid/fapi/pull/855 |
| PR #860 — Remove Bitbucket placeholder files | https://github.com/openid/fapi/pull/860 |
| Issue #693 — Case sensitivity of audience comparison (closed) | https://github.com/openid/fapi/issues/693 |
| Issue #718 — Outstanding FAPI CIBA correction | https://github.com/openid/fapi/issues/718 |
| Issue #738 — Confirmation of continued use (UAE) | https://github.com/openid/fapi/issues/738 |
| Issue #845 — Dedicated FAPI CIBA call | https://github.com/openid/fapi/issues/845 |
| Issue #848 — Audience value handling and certification tooling | https://github.com/openid/fapi/issues/848 |
| Issue #857 — Inconsistent timestamp naming in Grant Management | https://github.com/openid/fapi/issues/857 |
| Issue #859 — Add reference to cross-device flow security BCP | https://github.com/openid/fapi/issues/859 |
| RFC 10027 — Security BCP for cross-device flows | https://datatracker.ietf.org/doc/rfc10027/ |
| Federation Extensions Implementer's Drafts — notice of vote | https://openid.net/notice-of-vote-to-approve-proposed-implementers-drafts-of-two-openid-federation-extensions/ |
| OpenID Connect Key Binding Implementer's Draft — notice of vote | https://openid.net/notice-of-vote-for-proposed-implementers-draft-of-openid-connect-key-binding/ |
| OIDF policies (Note Well) | https://openid.net/policies/ |
| 2027 OIDF Global Conference | https://openid.net/conference/ |
The following points need your confirmation before publication.
- Issue #853 number. The issue on residual Bitbucket links was referred to on the call only verbally, as "eight fifty-three", and was never linked in chat. I have recorded it as #853, but please verify the number against the repository.
- "DCHP" working group. Mike Leszcz's chat text refers to "DCP and DCHP WG meetings" on 2026-08-31 in Geneva. I have reproduced it verbatim; please confirm the correct expansion of DCHP (or whether it is a typo).
- "MinSafe" (Chile). The transcript renders the second Chilean team name as "MinSafe" alongside the CMF. This is likely a rendering of a Ministry of Finance body; please supply the correct name.
- "Elizabeth" (OIDF staff at GDC). Given name only in the transcript, no surname or affiliation stated. Please confirm the full name.
- "Lucas" → Łukasz Jaromin. In the Issue #738 discussion Joseph Heenan refers to "Lucas". I have read this as Łukasz Jaromin (Raidiam); please confirm.
- Issue #718 subject matter. The substance of #718 was not restated on the call beyond it being a FAPI CIBA item that can still be corrected pre-Final. I have described it generically; a one-line subject from the ticket would improve the note.
- Issue #848 scope. The discussion covered the certification tooling status and the "new audience value", but the issue's own framing was not stated. Please confirm my characterisation of the title.
- RFC 10027 title. The transcript establishes only that it is a BCP on the security of cross-device flows. I have described it accordingly rather than quoting a title; please substitute the exact title if you want it in the notes.
- Tentative date of 2026-09-09. The Chair said "the ninth" without a month. Given the week-after-GDC framing and Peter Stanley's return on 2026-08-25, I have read this as Wednesday 2026-09-09. Christopher Robbertse said "travelling" immediately afterwards — it is unclear from the recording whether this was a conflict he was raising for himself. Please confirm.
- Christopher Robbertse in the attendee list. He did not enter his name in the roll-call chat but did participate. I have listed him as a full attendee; say the word if you would prefer him footnoted instead.