FAPI Working Group - Specifications

FAPI security profile is a general-purpose, high-security OAuth 2 profile used for API protection. It has been adopted by many ecosystems in many countries to support open data, open banking and identity initiatives.

FAPI Working Group
OVERVIEW

FAPI Working Group
CHARTER

FAPI Working Group
SPECIFICATIONS

FAPI Working Group
REPOSITORY

The working group has been developing the following specifications:

Final Specifications

FAPI 2 Specifications

FAPI 2.0 is an evolution of FAPI 1.0. V.2.0 was designed based on an agreed security model; it is simpler to implement and has a broader scope than FAPI 1.0, as it aims for complete interoperability at the interface between the client and the authorisation server, as well as interoperable security mechanisms at the interface between the client and the resource server.

FAPI WG strongly recommends that all new ecosystems adopt FAPI 2.0; for existing FAPI 1.0 ecosystems, to plan a transition to FAPI 2.0.

  • FAPI 2.0 Message Signing – An API security profile for signing and verifying certain FAPI 2.0 requests and responses.
  • FAPI 2.0 Security Profile – A secured OAuth profile that aims to provide specific implementation guidelines for security and interoperability. Formally verified under FAPI 2.0 Attacker Model. 
  • FAPI 2.0 Attacker Model – An attacker model that informs the decisions on security mechanisms employed by the FAPI security profiles.
FAPI 1 Specifications
 FAPI 1 is a widely deployed highly secured OpenID Connect and OAuth profile that aims to provide specific implementation guidelines for security and interoperability. It is formally analized. 

Implementer's Drafts

Errata Corrections

  • Errata Corrections to JWT Secured Authorization Response Mode for OAuth 2.0 (JARM) – defines a new JWT-based mode to encode OAuth authorization responses. Clients are enabled to request the transmission of the authorization response parameters along with additional data in JWT format. This mechanism enhances the security of the standard authorization response with support for signing and optional encryption of the response. A signed response provides message integrity, sender authentication, audience restriction, and protection from mix-up attacks. Encrypting the response provides confidentiality of the response parameter values. The JWT authorization response mode can be used in conjunction with any response type.

Drafts

Security Analyses

Resources