Issues

• FAPI 2.0 submissions to ITU-T

  openid/fapi#872 · Filter by author bhjelm opened on Oct 2, 2026

• Create a versioned copy of FAPI 2.0 Implementation Advice

  component: Implementation & Deployment Advice
  openid/fapi#871 · Filter by author sakimura opened on Sep 30, 2026 · 1st Implementers Draft

• OWASP ASVS 5.0 section 10.4.8 requires strict refresh token expiry, which conflicts with FAPI 2.0 SP 5.3.2.1-9

  openid/fapi#864 · Filter by author sakimura opened on Aug 27, 2026
  2

• detecting inconsistent .well-known/openid-configuration vs .well-known/oauth-authorization-server on conformance tests

  component: Certificationcomponent: FAPI2: Advanced Authorizationcomponent: Implementation & Deployment Advice
  openid/fapi#863 · Filter by author jogu opened on Aug 26, 2026 · 1st Implementers Draft
  1

  

• meaning of FAPI2 requirements around publishing discovery data

  component: Certificationcomponent: FAPI2: Security Profile
  openid/fapi#862 · Filter by author jogu opened on Aug 26, 2026
  1

• last_updated_at vs last_update

  component: Grant Management
  openid/fapi#857 · Filter by author jogu opened on Aug 12, 2026
  1

  

• lots of urls in the repo still point at bitbucket

  openid/fapi#853 · Filter by author jogu opened on Aug 12, 2026
  1

• Hard coded algs in FAPI 2.0

  openid/fapi#852 · Filter by author sakimura opened on Aug 12, 2026

• Is FAPI 2.0 being used in Agentic AI flows (MCP?)

  openid/fapi#849 · Filter by author gffletch opened on Jul 13, 2026
  7

  

• how do we handle FAPI1 private_key_jwt aud changes in certification tools

  component: Certificationmigrated-from-bitbucketpriority: majortype: bug
  openid/fapi#848 · Filter by author bitbucket-import-issues opened on Jul 2, 2026
  5

• Crypto Streangth- JP CRYPTO REC recommended 192 bits instead of 128 bits as of today.

  migrated-from-bitbucketpriority: majortype: task
  openid/fapi#846 · Filter by author bitbucket-import-issues opened on Jul 2, 2026 · Errata
  1

• Publishing updated draft of FAPI-CIBA

  component: CIBAmigrated-from-bitbucketpriority: majortype: task
  openid/fapi#845 · Filter by author bitbucket-import-issues opened on Jul 2, 2026
  5

  

• FAPI not currently compliant with CNSA 2.0

  component: FAPI2: Security Profilemigrated-from-bitbucketpriority: minortype: bug
  openid/fapi#844 · Filter by author bitbucket-import-issues opened on Jul 2, 2026
  3

• OAuth security BCP addition

  component: FAPI2: Security Profilemigrated-from-bitbucketpriority: majortype: bug
  openid/fapi#843 · Filter by author bitbucket-import-issues opened on Jul 2, 2026
  2

• FAPI2.0 OSCAL Profile

  component: FAPI2: Security Profilemigrated-from-bitbucketpriority: minortype: task
  openid/fapi#839 · Filter by author bitbucket-import-issues opened on Jul 2, 2026 · FINAL
  7

• FAPI2: [Attacker Model ISO/IEC 26083-2 Review Comments] General and Editorial updates

  component: FAPI2: Attacker Modelmigrated-from-bitbucketpriority: majortype: proposal
  openid/fapi#838 · Filter by author bitbucket-import-issues opened on Jul 2, 2026

• FAPI2: [Security Profile ISO/IEC 26083-1 Review Comments] General and Editorial updates

  component: FAPI2: Security Profilemigrated-from-bitbucketpriority: majortype: proposal
  openid/fapi#837 · Filter by author bitbucket-import-issues opened on Jul 2, 2026
  2

• Abstract should not be there for FAPI1

  component: FAPI 1: Advancedmigrated-from-bitbucketpriority: majortype: bug
  openid/fapi#834 · Filter by author bitbucket-import-issues opened on Jul 2, 2026 · Errata
  2

• Yet other editorial fixes for ISO adoption

  migrated-from-bitbucketpriority: trivialtype: bug
  openid/fapi#833 · Filter by author bitbucket-import-issues opened on Jul 2, 2026
  1

• Submit FAPI 2.0 MS IANA registrations

  component: FAPI2: Message Signingmigrated-from-bitbucketpriority: majortype: task
  openid/fapi#832 · Filter by author bitbucket-import-issues opened on Jul 2, 2026
  3

• Browser swapping attacks

  component: FAPI2: Security Profilemigrated-from-bitbucketpriority: majortype: bug
  openid/fapi#831 · Filter by author bitbucket-import-issues opened on Jul 2, 2026
  7

• FAPI1: [ISO/IEC 25791-1 Review Comments] Remove "ISODIR2 ISO/IEC Directives Part 2" from Bibliography

  component: FAPI 1: Baselinemigrated-from-bitbucketpriority: minortype: proposal
  openid/fapi#769 · Filter by author bitbucket-import-issues opened on Jul 2, 2026
  3

  

• Some FAPI2SP clauses about the authorization code flow are in the wrong section

  component: FAPI2: Security Profilemigrated-from-bitbucketpriority: majortype: bug
  openid/fapi#743 · Filter by author bitbucket-import-issues opened on Jul 2, 2026 · Errata
  1

  

• Agent Payments Protocol (AP2) Impacts to FAPI

  migrated-from-bitbucketpriority: minortype: task
  openid/fapi#742 · Filter by author bitbucket-import-issues opened on Jul 2, 2026
  2

• Is nbf a mandatory requirement for request object in FAPI 2 message signing?

  component: FAPI2: Message Signingmigrated-from-bitbucketpriority: minortype: enhancement
  openid/fapi#741 · Filter by author bitbucket-import-issues opened on Jul 2, 2026 · FINAL
  3