Publishing updated draft of FAPI-CIBA

[bitbucket-import-issues]

Originally submitted by josephheenan (Joseph Heenan) on 2026-03-16

The last published working group draft of FAPI-CIBA was in 2019 (what became the first implementer's draft).

There have been various updates to the spec spec, but nothing published.

The spec has/is being adopted by Brazil (who use FAPI1) and ConnectID (who use FAPI2) and the certification team is in the process of developing tests for both ecosystems.

I think we should probably publish a new draft and at least an implementer's draft (or perhaps go to final) but we should triage the open issues first I guess.

---

Bitbucket status: open

Bitbucket origin: issue 857

[bitbucket-import-issues]

Originally submitted by Nat (Nat Sakimura) on 2026-03-18

OK. Since we changed the filename from openid-financial-api-ciba.md to fapi-ciba.md, there is no easy way to compare them on the web UI.

Also, the file format was changed from pandoc markdown to XML2RFC markdown, and there are a lot of changes due to this and taking meaningful diffs is not easy.

The conversion to the new filename and the formatting was done in 2023-08-09 (17bf008).
So, taking a diff between the 2019-08-16 version (09415d8) and one version before 17bf008 = 9f3fe5b, and between 17bf008 and the current version (b77092d) might be the way to go.

diffs between 09415d8 and 9f3fe5b

https://bitbucket.org/openid/fapi/diff/Financial_API_WD_CIBA.md?at=master&diff1=09415d8a94c9e8d7860be37fb6adeec178562fe4&diff2=9f3fe5bbdfcd82bac2f897a85918b2f68c69696a

diffs between 09415d8 and 17bf008

https://bitbucket.org/openid/fapi/diff/fapi-ciba.md?at=master&diff1=17bf008ef4fe19440e1761d9f57c2cfeabaf18e6&diff2=b77092d8454da13f9bc94c0ef269a1ea9390a464

[bitbucket-import-issues]

Originally submitted by dgtonge (Dave Tonge) on 2026-03-25

dedicated call to be arranged

[sakimura]

Best Current Practice for Security of Cross-Device Flows
RFC 10027, also known as BCP 247, should also be taken into account.

A new issue, #859, was opened.

Nat to coordinate the dedicated call.

[davetonge-mh]

I have opened PRs for the CIBA spec issues I think we can resolve now:

• FAPI CIBA #580 → FAPI-CIBA: unsigned backchannel authentication requests by default #865
• CIBA - Make clear limitation of binding message #597 → FAPI-CIBA: binding message limitations #866
• FAPI-CIBA shall be inheriting these sections from a chosen security profile (FAPI 1 or FAPI 2)? #675 → FAPI-CIBA: inherit TLS and algorithm requirements #867
• README / GitHub path cleanup → Fix README links for CIBA and FAPI 2 #868

BCP 247 is already referenced.

I have closed #229, #674 and #676 as wontfix. I am proposing we also close #506.

[davetonge-mh]

Added this PR to get ready for publication also: #869