These endpoints are not implemented by Data Holders and Data Recipients. They are hosted by the Register for consumption by participants.
diff --git a/docs/includes/known-issues b/docs/includes/known-issues
index 437a322c..ca9b73cb 100644
--- a/docs/includes/known-issues
+++ b/docs/includes/known-issues
@@ -1,6 +1,8 @@
Known Issues
There are certain aspects of the standards that are actively under review. These known issues are articulated in the following table.
-
+The known issue related to the incorrect obligation date for
+Get Metrics v5 has been removed as it has been resolved
+
Issue
@@ -8,10 +10,6 @@
-Incorrect obligation date for Get Metrics v5
-The future dated obligation date has been incorrectly documented in the standards as June 13th 2024. This was a documentation error when v1.25.0 of the standards were published. According to the decision of the Data Standards Chair (Decision 288) the obligation date for the implementation of Get Metrics v5 is May 13th 2024 . This will be corrected in the next release of the standards.
-
-
Register APIs use local version of common definitions
The Register APIs use a locally defined version of common schema definitions such as ResponseErrorList
for error responses. These need to be updated to reference common swagger specifications inherited by the Common Swagger spec.
diff --git a/docs/includes/nfrs b/docs/includes/nfrs
index 22550862..38419d2c 100644
--- a/docs/includes/nfrs
+++ b/docs/includes/nfrs
@@ -141,11 +141,6 @@
For Unattended traffic during high traffic periods only best effort support is required.
-Updated the static site wide TPS thresholds with a graduated set of
-thresholds depending on the number of active authorisations established
-with the data holder
-
-
For secure traffic (both Customer Present and Unattended) the following traffic thresholds will apply:
@@ -177,9 +172,9 @@ with the data holder
Unattended calls should be managed to avoid short term bursts of traffic
-
+ Added the Low Velocity Data Sets section
-
Low Velocity Data Sets
-For endpoints that provide access to data that is low velocity (ie. the data does not change frequently) the Data Recipient Software Product is expected to cache the results of any data they receive and not request the same resource again until the data may reasonably have changed.
+Low Velocity Data Sets
+
+For endpoints that provide access to data that is low velocity (ie. the data does not change frequently) the Data Recipient Software Product is expected to cache the results of any data they receive and not request the same resource again until the data may reasonably have changed.
For low velocity data sets, if the same data is requested repeatedly a Data Holder may reject subsequent requests for the same data during a specified period.
diff --git a/docs/includes/obsolete/get-metrics-v3.html b/docs/includes/obsolete/get-metrics-v3.html
index 6b5e0477..c12f1467 100644
--- a/docs/includes/obsolete/get-metrics-v3.html
+++ b/docs/includes/obsolete/get-metrics-v3.html
@@ -282,7 +282,9 @@
Get Metrics V3
This page documents the deprecated version 3 of the Get Metrics end point.
-This version does not yet have an obsolescence date and must continue to be supported by data holders.
+Support for this version is not required for Data Holders going live on, or after, 1st November 2023.
+
+Other Data Holders MAY retire this version from the earlier of 13th May 2023 or from the time ACCC announce that they no longer call this version.
Get Metrics
diff --git a/docs/includes/obsolete/get-metrics-v4.html b/docs/includes/obsolete/get-metrics-v4.html
index eacc5fde..8c205420 100644
--- a/docs/includes/obsolete/get-metrics-v4.html
+++ b/docs/includes/obsolete/get-metrics-v4.html
@@ -285,7 +285,7 @@
Get Metrics V4
This page documents the deprecated version 4 of the Get Metrics end point.
-This version must be implemented by November 1st 2023 and may be obsoleted once v5 has been implemented
+This version MUST be implemented by November 1st 2023 and MAY be retured once v5 has been implemented
Get Metrics
diff --git a/docs/includes/releasenotes/releasenotes.1.26.0.html b/docs/includes/releasenotes/releasenotes.1.26.0.html
new file mode 100644
index 00000000..c787d76e
--- /dev/null
+++ b/docs/includes/releasenotes/releasenotes.1.26.0.html
@@ -0,0 +1,306 @@
+
+
+
+
+
+
+
+ Consumer Data Standards - v1.26.0 Release Notes
+
+
+
+
+
+
+
+
+
+
+
+ NAV
+
+
+
+
+
+
+
+
+
+
+
V1.26.0 Release Notes
+
Release notes for version v1.26.0 of the CDR Standards .
+
Changes Made Change Requests
+
This release addresses the following minor defects raised on Standards Staging :
+
+
+
+
This release addresses the following change requests raised on Standards Maintenance :
+
+
+
Decision Proposals
+
This release addresses the following Decision Proposals published on Standards :
+
+
+
Introduction
+
No Change
+
High Level Standards
+
No Change
+
API End Points
+
+
+Change
+Description
+Link
+
+
+
+Modified Get Metrics Obligations
+Changes to the obligation dates for Get Metrics v3 as determined in Decision 322
+Admin APIs
+
+
+
+
No Change
+
Register Standards
+
No Change
+
Consumer Experience
+
No Change
+
Non Functional Requirements
+
No Change
+
Known Issues
+
Resolved the known issue related to the incorrect obligation date for Get Metrics v5
+
+
+
+
+
diff --git a/docs/includes/swagger/cds_admin.json b/docs/includes/swagger/cds_admin.json
index 39dee4f9..d3b4f529 100644
--- a/docs/includes/swagger/cds_admin.json
+++ b/docs/includes/swagger/cds_admin.json
@@ -12,7 +12,7 @@
"url" : "https://opensource.org/licenses/MIT"
},
"title" : "CDR Admin API",
- "version" : "1.25.0"
+ "version" : "1.26.0"
},
"servers" : [ {
"url" : "https://data.holder.com.au/cds-au/v1"
@@ -103,7 +103,7 @@
},
"/admin/metrics" : {
"get" : {
- "description" : "This end point allows the ACCC to obtain operational statistics from the Data Holder (at the Data Holder Brand level) on the operation of their CDR compliant implementation. The statistics obtainable from this end point are determined by the non-functional requirements for the CDR regime.\n\nThis end point is not required to be implemented by the Australian Energy Market Operator, the Australian Energy Regulator or the Department of State administered by the Minister of Victoria administering the National Electricity (Victoria) Act 2005 (Vic).\n\nNOTE: This version must be implemented by **June 13th 2024**\n\nObsolete versions: [v1](includes/obsolete/get-metrics-v1.html) [v2](includes/obsolete/get-metrics-v2.html).\n\nDeprecated versions:\n\n- [v3](includes/obsolete/get-metrics-v3.html)\n- [v4](includes/obsolete/get-metrics-v4.html) - This version, or v5, must be implemented by **November 1st 2023**\n\nIf the Data Holder supports private_key_jwt client authentication they MUST validate the scope.",
+ "description" : "This end point allows the ACCC to obtain operational statistics from the Data Holder (at the Data Holder Brand level) on the operation of their CDR compliant implementation. The statistics obtainable from this end point are determined by the non-functional requirements for the CDR regime.\n\nThis end point is not required to be implemented by the Australian Energy Market Operator, the Australian Energy Regulator or the Department of State administered by the Minister of Victoria administering the National Electricity (Victoria) Act 2005 (Vic).\n\nNOTE: This version **MUST** be implemented by **May 13th 2024**\n\nObsolete versions: [v1](includes/obsolete/get-metrics-v1.html) [v2](includes/obsolete/get-metrics-v2.html).\n\nDeprecated versions:\n\n- [v3](includes/obsolete/get-metrics-v3.html) - Implementation not required for Data Holders going live on, or after, 1st November 2023. Other Data Holders **MAY** retire this version from the earlier of **13th May 2023** or from the time ACCC announce that they no longer call this version\n- [v4](includes/obsolete/get-metrics-v4.html) - This version, or v5, **MUST** be implemented by **November 1st 2023**\n\nIf the Data Holder supports private_key_jwt client authentication they MUST validate the scope.",
"operationId" : "getMetrics",
"parameters" : [ {
"description" : "The period of metrics to be requested. Values can be CURRENT (meaning metrics for current period, dependent on the metric type), HISTORIC (meaning metrics for previous period, depending on the metric type) or ALL. If absent the default is ALL.",
diff --git a/docs/includes/swagger/cds_admin.yaml b/docs/includes/swagger/cds_admin.yaml
index 4224a198..4d9c5e2b 100644
--- a/docs/includes/swagger/cds_admin.yaml
+++ b/docs/includes/swagger/cds_admin.yaml
@@ -11,7 +11,7 @@ info:
name: MIT License
url: https://opensource.org/licenses/MIT
title: CDR Admin API
- version: 1.25.0
+ version: 1.26.0
servers:
- url: https://data.holder.com.au/cds-au/v1
paths:
@@ -99,14 +99,14 @@ paths:
This end point is not required to be implemented by the Australian Energy Market Operator, the Australian Energy Regulator or the Department of State administered by the Minister of Victoria administering the National Electricity (Victoria) Act 2005 (Vic).
- NOTE: This version must be implemented by **June 13th 2024**
+ NOTE: This version **MUST** be implemented by **May 13th 2024**
Obsolete versions: [v1](includes/obsolete/get-metrics-v1.html) [v2](includes/obsolete/get-metrics-v2.html).
Deprecated versions:
- - [v3](includes/obsolete/get-metrics-v3.html)
- - [v4](includes/obsolete/get-metrics-v4.html) - This version, or v5, must be implemented by **November 1st 2023**
+ - [v3](includes/obsolete/get-metrics-v3.html) - Implementation not required for Data Holders going live on, or after, 1st November 2023. Other Data Holders **MAY** retire this version from the earlier of **13th May 2023** or from the time ACCC announce that they no longer call this version
+ - [v4](includes/obsolete/get-metrics-v4.html) - This version, or v5, **MUST** be implemented by **November 1st 2023**
If the Data Holder supports private_key_jwt client authentication they MUST validate the scope.
operationId: getMetrics
diff --git a/docs/includes/swagger/cds_banking.json b/docs/includes/swagger/cds_banking.json
index 34a6ea49..2e1b188a 100644
--- a/docs/includes/swagger/cds_banking.json
+++ b/docs/includes/swagger/cds_banking.json
@@ -12,7 +12,7 @@
"url" : "https://opensource.org/licenses/MIT"
},
"title" : "CDR Banking API",
- "version" : "1.25.0"
+ "version" : "1.26.0"
},
"servers" : [ {
"url" : "https://data.holder.com.au/cds-au/v1"
diff --git a/docs/includes/swagger/cds_banking.yaml b/docs/includes/swagger/cds_banking.yaml
index 4aa84cfd..71c6c308 100644
--- a/docs/includes/swagger/cds_banking.yaml
+++ b/docs/includes/swagger/cds_banking.yaml
@@ -11,7 +11,7 @@ info:
name: MIT License
url: https://opensource.org/licenses/MIT
title: CDR Banking API
- version: 1.25.0
+ version: 1.26.0
servers:
- url: https://data.holder.com.au/cds-au/v1
paths:
diff --git a/docs/includes/swagger/cds_common.json b/docs/includes/swagger/cds_common.json
index 21b25e4d..a008df9e 100644
--- a/docs/includes/swagger/cds_common.json
+++ b/docs/includes/swagger/cds_common.json
@@ -12,7 +12,7 @@
"url" : "https://opensource.org/licenses/MIT"
},
"title" : "CDR Common API",
- "version" : "1.25.0"
+ "version" : "1.26.0"
},
"servers" : [ {
"url" : "https://data.holder.com.au/cds-au/v1"
diff --git a/docs/includes/swagger/cds_common.yaml b/docs/includes/swagger/cds_common.yaml
index 1191a04d..11e75e9c 100644
--- a/docs/includes/swagger/cds_common.yaml
+++ b/docs/includes/swagger/cds_common.yaml
@@ -11,7 +11,7 @@ info:
name: MIT License
url: https://opensource.org/licenses/MIT
title: CDR Common API
- version: 1.25.0
+ version: 1.26.0
servers:
- url: https://data.holder.com.au/cds-au/v1
paths:
diff --git a/docs/includes/swagger/cds_dcr.json b/docs/includes/swagger/cds_dcr.json
index ba6399e7..f157e1b4 100644
--- a/docs/includes/swagger/cds_dcr.json
+++ b/docs/includes/swagger/cds_dcr.json
@@ -3,7 +3,7 @@
"info" : {
"description" : "This specification defines the APIs for Data Holders exposing Dynamic Client Registration endpoints.",
"title" : "CDR Dynamic Client Registration API",
- "version" : "1.25.0"
+ "version" : "1.26.0"
},
"servers" : [ {
"url" : "https://data.holder.com.au/"
diff --git a/docs/includes/swagger/cds_dcr.yaml b/docs/includes/swagger/cds_dcr.yaml
index 015a04fc..b64bb755 100644
--- a/docs/includes/swagger/cds_dcr.yaml
+++ b/docs/includes/swagger/cds_dcr.yaml
@@ -3,7 +3,7 @@ info:
description: This specification defines the APIs for Data Holders exposing Dynamic
Client Registration endpoints.
title: CDR Dynamic Client Registration API
- version: 1.25.0
+ version: 1.26.0
servers:
- url: https://data.holder.com.au/
paths:
diff --git a/docs/includes/swagger/cds_energy.json b/docs/includes/swagger/cds_energy.json
index 8ea5cf26..27cb88cc 100644
--- a/docs/includes/swagger/cds_energy.json
+++ b/docs/includes/swagger/cds_energy.json
@@ -3,7 +3,7 @@
"info" : {
"description" : "Consumer Data Right end points and payloads for the Energy sector",
"title" : "CDR Energy API",
- "version" : "1.25.0"
+ "version" : "1.26.0"
},
"servers" : [ {
"url" : "/"
diff --git a/docs/includes/swagger/cds_energy.yaml b/docs/includes/swagger/cds_energy.yaml
index e3a34b42..231ae892 100644
--- a/docs/includes/swagger/cds_energy.yaml
+++ b/docs/includes/swagger/cds_energy.yaml
@@ -2,7 +2,7 @@ openapi: 3.0.3
info:
description: Consumer Data Right end points and payloads for the Energy sector
title: CDR Energy API
- version: 1.25.0
+ version: 1.26.0
servers:
- url: /
paths:
diff --git a/docs/includes/swagger/cds_energy_sdh.json b/docs/includes/swagger/cds_energy_sdh.json
index bea5cd11..83df0445 100644
--- a/docs/includes/swagger/cds_energy_sdh.json
+++ b/docs/includes/swagger/cds_energy_sdh.json
@@ -3,7 +3,7 @@
"info" : {
"description" : "Consumer Data Right end points and payloads for Secondary Data Holder for the Energy sector",
"title" : "CDR Energy Secondary Data Holder API",
- "version" : "1.25.0"
+ "version" : "1.26.0"
},
"servers" : [ {
"url" : "/"
diff --git a/docs/includes/swagger/cds_energy_sdh.yaml b/docs/includes/swagger/cds_energy_sdh.yaml
index 205dace7..e917ee2c 100644
--- a/docs/includes/swagger/cds_energy_sdh.yaml
+++ b/docs/includes/swagger/cds_energy_sdh.yaml
@@ -3,7 +3,7 @@ info:
description: Consumer Data Right end points and payloads for Secondary Data Holder
for the Energy sector
title: CDR Energy Secondary Data Holder API
- version: 1.25.0
+ version: 1.26.0
servers:
- url: /
paths:
diff --git a/docs/includes/swagger/cds_register.json b/docs/includes/swagger/cds_register.json
index 77f75c20..67b17f36 100644
--- a/docs/includes/swagger/cds_register.json
+++ b/docs/includes/swagger/cds_register.json
@@ -2,7 +2,7 @@
"openapi" : "3.0.3",
"info" : {
"title" : "CDR Participant Discovery API",
- "version" : "1.25.0"
+ "version" : "1.26.0"
},
"servers" : [ {
"url" : "https:///"
diff --git a/docs/includes/swagger/cds_register.yaml b/docs/includes/swagger/cds_register.yaml
index 59cef5e5..2b68399c 100644
--- a/docs/includes/swagger/cds_register.yaml
+++ b/docs/includes/swagger/cds_register.yaml
@@ -1,7 +1,7 @@
openapi: 3.0.3
info:
title: CDR Participant Discovery API
- version: 1.25.0
+ version: 1.26.0
servers:
- url: https:///
paths:
diff --git a/docs/includes/swagger/cds_telco.json b/docs/includes/swagger/cds_telco.json
index d2833d51..75e68814 100644
--- a/docs/includes/swagger/cds_telco.json
+++ b/docs/includes/swagger/cds_telco.json
@@ -12,7 +12,7 @@
"url" : "https://opensource.org/licenses/MIT"
},
"title" : "CDR Telco API",
- "version" : "1.25.0"
+ "version" : "1.26.0"
},
"servers" : [ {
"url" : "https://data.holder.com.au/cds-au/v1"
diff --git a/docs/includes/swagger/cds_telco.yaml b/docs/includes/swagger/cds_telco.yaml
index eadaadf8..fe6475bd 100644
--- a/docs/includes/swagger/cds_telco.yaml
+++ b/docs/includes/swagger/cds_telco.yaml
@@ -11,7 +11,7 @@ info:
name: MIT License
url: https://opensource.org/licenses/MIT
title: CDR Telco API
- version: 1.25.0
+ version: 1.26.0
servers:
- url: https://data.holder.com.au/cds-au/v1
paths:
diff --git a/docs/index.html b/docs/index.html
index cf2f6941..100da1e1 100644
--- a/docs/index.html
+++ b/docs/index.html
@@ -1431,7 +1431,7 @@ Introduction
Version
-These standards represent version 1.25.0 of the high level standards. See the versioning section for more information on how versions are managed in the standard.
+These standards represent version 1.26.0 of the high level standards. See the versioning section for more information on how versions are managed in the standard.
Interpretation
@@ -1443,10 +1443,12 @@ Future Dated Obligations
The table below highlights these areas of the standards.
-Removed legacy obligation dates more than 6 months in the past
-Fixed spelling of "Register"
+Added the retirement details for Get Metrics v3
-Added FDOs for decision 288 and 303
+Corrected the obligation date for Get Metrics v5
+
+Replaced the term `obsolete` with `retire` to clarify the
+intent of these statements
@@ -1458,17 +1460,17 @@ Future Dated Obligations
Get Account Detail V1
-Data holders MAY obsolete version 1 of this end point from February 28th 2023. Data recipients MUST upgrade their implementations to use version 2 by this time
+Data holders MAY retire version 1 of this end point from February 28th 2023. Data recipients MUST upgrade their implementations to use version 2 by this time
February 28th 2023
Get Product Detail V3
-Data holders MAY obsolete version 3 of this end point from February 28th 2023. Data recipients MUST upgrade their implementations to use version 4 by this time
+Data holders MAY retire version 3 of this end point from February 28th 2023. Data recipients MUST upgrade their implementations to use version 4 by this time
February 28th 2023
Get Customer Detail V1
-Data holders MAY obsolete version 1 of this end point from February 28th 2023. Data recipients MUST upgrade their implementations to use version 2 by this time
+Data holders MAY retire version 1 of this end point from February 28th 2023. Data recipients MUST upgrade their implementations to use version 2 by this time
February 28th 2023
@@ -1508,32 +1510,32 @@ Future Dated Obligations
Get Generic Plan Detail V2
-Data Holders MUST implement v2 of this endpoint by November 1st 2023 Data Holders MAY obsolete v1 of this endpoint from September 9th 2024
+Data Holders MUST implement v2 of this endpoint by November 1st 2023 Data Holders MAY retire v1 of this endpoint from September 9th 2024
November 1st 2023
Get Energy Account Detail V3
-Data Holders MUST implement v3 of this endpoint by November 1st 2023 Data Holders MAY obsolete v2 of this endpoint from September 9th 2024
+Data Holders MUST implement v3 of this endpoint by November 1st 2023 Data Holders MAY retire v2 of this endpoint from September 9th 2024
November 1st 2023
Get Billing For Account V2
-Data Holders MUST implement v2 of this endpoint by November 1st 2023 Data Holders MAY obsolete v1 of this endpoint from September 9th 2024
+Data Holders MUST implement v2 of this endpoint by November 1st 2023 Data Holders MAY retire v1 of this endpoint from September 9th 2024
November 1st 2023
Get Bulk Billing V2
-Data Holders MUST implement v2 of this endpoint by November 1st 2023 Data Holders MAY obsolete v1 of this endpoint from September 9th 2024
+Data Holders MUST implement v2 of this endpoint by November 1st 2023 Data Holders MAY retire v1 of this endpoint from September 9th 2024
November 1st 2023
Get Billing For Specific Accounts V2
-Data Holders MUST implement v2 of this endpoint by November 1st 2023 Data Holders MAY obsolete v1 of this endpoint from September 9th 2024
+Data Holders MUST implement v2 of this endpoint by November 1st 2023 Data Holders MAY retire v1 of this endpoint from September 9th 2024
November 1st 2023
Get Metrics V4
-Data Holders MUST implement v4 or V5 of this endpoint by November 1st 2023 Data Holders MAY deprecate v4 of this endpoint once V5 is implemented**
+Data Holders MUST implement v4 or V5 of this endpoint by November 1st 2023 Data Holders MAY retire v4 of this endpoint once V5 is implemented
November 1st 2023
@@ -1553,29 +1555,33 @@ Future Dated Obligations
Get Scheduled Payments for Account V2
-Data Holders MUST implement v2 of this endpoint by March 11th 2024 Data Holders MAY obsolete v1 of this endpoint from September 9th 2024
+Data Holders MUST implement v2 of this endpoint by March 11th 2024 Data Holders MAY retire v1 of this endpoint from September 9th 2024
March 11th 2024
Get Scheduled Payments Bulk V2
-Data Holders MUST implement v2 of this endpoint by March 11th 2024 Data Holders MAY obsolete v1 of this endpoint from September 9th 2024
+Data Holders MUST implement v2 of this endpoint by March 11th 2024 Data Holders MAY retire v1 of this endpoint from September 9th 2024
March 11th 2024
Get Scheduled Payments For Specific Accounts V2
-Data Holders MUST implement v2 of this endpoint by March 11th 2024 Data Holders MAY obsolete v1 of this endpoint from September 9th 2024
+Data Holders MUST implement v2 of this endpoint by March 11th 2024 Data Holders MAY retire v1 of this endpoint from September 9th 2024
March 11th 2024
+Get Metrics V3
+Data Holders MAY retire v3 of this endpoint by the earlier of 13th May 2024 or when the ACCC announce that this version is no longer being called Data Holders going live on, or after, 1st November 2023 are not required to support this version
+May 13th 2024
+
+
Get Metrics V5
-Data Holders MUST implement V5 of this endpoint by June 13th 2024 Data Holders MAY deprecate v4 of this endpoint once V5 is implemented**
-June 13th 2024
+Data Holders MUST implement v5 of this endpoint by May 13th 2024 Data Holders MAY deprecate v4 of this endpoint once V5 is implemented
+May 13th 2024
-Register Implementation Schedule Removed the dependency schedule content for the Register APIs
-and linked to the ACCC implementation schedule.
-
+Register Implementation Schedule
+
The implementation of the Register APIs is managed by the ACCC.
Their implementation schedule is published here .
@@ -1584,12 +1590,8 @@ Endpoint Version Schedule
A table-view of all endpoint versioning is available here .
-Normative References Removed legacy FAPI references:
-- FAPI-R-Draft
-- FAPI-RW-Draft
-
-Updated PAR references to refer to RFC9126
-
+Normative References
+
Reference
@@ -1753,6 +1755,7 @@ Normative References Replaced FAPI draft references with FAPI 1.0 Final references.
-References pertain to the x-fapi-auth-date header.
-
+
Header Field
@@ -4114,13 +4115,15 @@ Withdrawal Standards
Security Profile
-Overview Removed legacy phasing of FAPI draft specifications. Only FAPI 1.0 Final is relied upon.
-
+Overview
+
This information security profile builds upon the foundations of the Financial-grade API Advanced Profile [FAPI-1.0-Advanced] and other standards relating to
Open ID Connect 1.0 [OIDC] .
For information on the specific normative references that underpin this profile refer to the Normative References section .
+
Symbols and Abbreviated terms
+
Removed legacy phasing requirements for FAPI 1.0 Final
-
-
-Data Recipient Software Products SHOULD NOT reuse "authorization_code" values, and if reused, it will be rejected.
-Data Recipient Software Products MAY send requests with a "x-fapi-customer-ip-address" header containing a valid IPv4 or IPv6 address.
-Data Recipient Software Products MUST support FAPI 1.0 Advanced Profile ([FAPI-1.0-Advanced] ).
-Data Recipient Software Products MUST use [RFC9126] (PAR) with [PKCE] ([RFC7636] ) and, if supported, MUST use S256 as the code challenge method.
-Data Recipient Software Products SHOULD use Authorization Code Flow.
+Data Recipient Software Products SHOULD record the following information each time an authorisation flow is executed: username (consumer’s ID at the Data Recipient Software Product), timestamp, IP, consent scopes and duration.
+Data Recipient Software Products SHOULD NOT reuse "authorization_code" values, and if reused, it will be rejected.
+Data Recipient Software Products MAY send requests with a "x-fapi-customer-ip-address" header containing a valid IPv4 or IPv6 address.
+Data Recipient Software Products MUST support FAPI 1.0 Advanced Profile ([FAPI-1.0-Advanced] ).
+Data Recipient Software Products MUST use [RFC9126] (PAR) with [PKCE] ([RFC7636] ) and, if supported, MUST use S256 as the code challenge method.
+Data Recipient Software Products SHOULD use Authorization Code Flow.
@@ -4659,8 +4654,7 @@ Software Statement Assertion (SSA)
An SSA is a digitally signed JSON Web Token (JWT) created in accordance with [JWT] that asserts metadata values about the client software.
-Replaced FAPI draft references with FAPI 1.0 Final references
-
+
Such that:
@@ -4982,7 +4976,6 @@ Registration Request using JWT
{
"signature":...
}
- Replaced FAPI draft references with FAPI 1.0 Final references
To register with a Data Holder, the Data Recipient sends an HTTP POST to the Data Holder registration endpoint.
@@ -4993,8 +4986,7 @@ Registration Request using JWT
The client registration request MUST contain the following claims in the JWT payload unless designated as Optional:
-Replaced FAPI draft references with FAPI 1.0 Final references
-
+
Claim
@@ -5122,8 +5114,7 @@ ID Token Algorithm Selectio
Data Holders MUST support at a minimum, 1 algorithm for each claim.
Data Recipients MUST support all the algorithms used in the ecosystem to ensure they can communicate with all Data Holders.
-Replaced FAPI draft references with FAPI 1.0 Final references
-
+
ID Token algorithm considerations remain relevant where the OIDC Hybrid Flow is leveraged as defined in the Consumer Data Standards and in accordance with sections 5.1.1 , 5.2.2.1 , and 5.2.3.1 of [FAPI-1.0-Advanced] .
JARM Response Encryption Considerations
If Data Holders support authorisation response encryption, they MUST support, at a minimum, one of each of the following alg
and enc
algorithms:
@@ -5717,18 +5708,15 @@ Tokens ID Token
}
ID Tokens are specified in section 2 of the [OIDC] standard.
-Baseline ID Token requirements Replaced FAPI draft references with FAPI 1.0 Final references
-
+Baseline ID Token requirements
In addition to the mandatory claims specified in section 2 of the [OIDC] standard, required claims for ID Tokens as part of Hybrid Flow authentication MUST align to section 3.3 (Authentication using the Hybrid Flow) of the [OIDC] standards and section 5.2.2 and section 8.4.3 of the [FAPI-1.0-Advanced] profile.
ID Tokens MUST be signed by Data Holders as specified in section 8.6 of [FAPI-1.0-Advanced] .
-OIDC Hybrid Flow requirements Replaced FAPI draft references with FAPI 1.0 Final references
-
+OIDC Hybrid Flow requirements
In accordance with [FAPI-1.0-Advanced] , ID Tokens MUST be signed and encrypted when returned to a Data Recipient Software Product from both the Authorisation End Point and Token End Point.
The ID Token returned from the Authorisation End Point MUST NOT contain any Personal Information (PI) claims.
-Hashing value for state and authorisation code Replaced FAPI draft references with FAPI 1.0 Final references
-
+Hashing value for state and authorisation code
The following requirements apply to the OIDC Hybrid Flow:
@@ -5743,8 +5731,7 @@ Access Token
An Access Token MUST expire between 2 minutes to 10 minutes after the Data Holder issues it (at the discretion of the Data Holder).
The process for refreshing an Access Token is described in section 12.1 of [OIDC] .
- Removed legacy phasing requirements for FAPI 1.0 Final
-
+
Data Holders MUST reject token request with an authorization code (Section 1.3.1 of [RFC6749] ) if it has been previously used
@@ -5756,8 +5743,7 @@ Refresh Token
The expiration time for a Refresh Token MUST be set by the Data Holder.
Refresh Token expiration MAY be any length of time greater than 28 days but MUST NOT exceed the end of the duration of sharing consented to by the Consumer.
-Removed legacy phasing requirements for FAPI 1.0 Final
-
+
Data Holders MUST NOT cycle refresh tokens (rotation). In other words, Refresh Tokens SHOULD be issued with an "exp" equal to the sharing duration authorised by the Customer.
@@ -5765,8 +5751,7 @@ Token Expiry
The expiry time for issued access tokens and refresh tokens MUST be deterministic for the Data Recipient Software Product.
In order to achieve this:
-Removed legacy phasing requirements for FAPI 1.0 Final
-
+
The Data Holder MUST indicate the lifetime in seconds of the access token in the expires_in
field of the JSON object returned by the token end-point (see section 4.2.2 of [OAUTH2] ).
@@ -5940,8 +5925,7 @@ Holder of Key Mechanism
OAUTB SHALL NOT be supported due to a lack industry support.
[MTLS] HoK allows issued tokens to be bound to a client certificate as specified in section 3 of [MTLS] .
-Ciphers Replaced FAPI draft RW references with FAPI 1.0 Final Advanced references. References pertain to the TLS considerations.
-
+Ciphers
Only the following cipher suites SHALL be permitted in accordance with section 8.5 of [FAPI-1.0-Advanced] :
+ Added "response_mode" to the non normative example. This demonstrates the use of Authorization Code Flow in conjunction with JARM and FAPI 1.0
-
#Decoded Request Object JWT
+#Decoded Request Object JWT
{
"iss": "s6BhdRkqt3",
@@ -6196,7 +6179,6 @@ Request Object
"code_challenge": "ZTA2ZmFkYjUyMjA2NDNhZGVkYzE1M2I5OTYzZDAxNGI2NWNiZjAxMzVhNDlmMTk2NTlmZWE0OWVhOTQxZjhmZg==",
"code_challenge_method": "S256"
}
-
Replaced FAPI draft references with FAPI 1.0 Final references
The Request Object is a signed and encoded JWT specified in section 6.1 of [OIDC] . As per [FAPI-1.0-Advanced] section 5.2.2 , the request
parameter MUST be present on requests to the [OIDC] Hybrid Authorisation End Point. The Request Object enables [OIDC] requests to be passed in a single and self-contained parameter.
@@ -6249,9 +6231,6 @@ Data Holders
Data Holders MUST support Pushed Authorisation Requests (PAR) via the pushed authorisation end point according to [PAR] .
-Removed legacy phasing requirements for FAPI 1.0 Final
-
-
Data Holders MUST support [RFC9126] (PAR) using [PKCE] ([RFC7636] ) with S256 as the code challenge method in accordance with [FAPI-1.0-Advanced] section 5.2.2 .
Data Holders MUST require PAR for authorisation request data in accordance with [RFC9126] where "require_pushed_authorization_requests" parameter is set to "true".
@@ -6261,8 +6240,8 @@ Data Holders
Data Holders MUST reject the reuse of "request_uri" values.
-Data Recipient Software Products Removed legacy phasing requirements for FAPI 1.0 Final
-
+Data Recipient Software Products
+
Data Recipients Software Products MUST send request object containing a "nbf" claim and an "exp" claim that has a lifetime of no longer than 60 minutes after the "nbf" claim.
Data Recipient Software Products MUST ONLY use a "request_uri" value once
@@ -6271,14 +6250,14 @@ Data Recipient Software Products <
Security Endpoints
+
OpenID Provider Configuration End Point
Non-Normative Example
-+ Adds examples for all metadata parameters required by the Data Standards and upstream normative references
-
## Request
+## Request
GET /.well-known/openid-configuration HTTP/1.1
Host: www.dh.com.au
@@ -6354,11 +6333,6 @@ OpenID Provider Configuration E
This endpoint does not require CORS .
-Replaced FAPI draft references with FAPI 1.0 Final references
-
-+ Adds all metadata parameters required by the Data Standards and upstream normative references
-
-
At a minimum, the Data Holder metadata MUST include:
[OIDD]
@@ -6370,11 +6344,11 @@ OpenID Provider Configuration E
grant_types_supported
: The list of the OAuth 2.0 Grant Type values supported
id_token_encryption_alg_values_supported
: The list of the supported JWE algorithms for securing the issued ID tokens. Must conform to [FAPI-RW-Draft] and [OIDD] . Required for Data Holders supporting OIDC Hybrid Flow
id_token_encryption_enc_values_supported
: The list of the supported JWE encryption methods for securing the issued ID tokens. Required for Data Holders supporting OIDC Hybrid Flow
-id_token_signing_alg_values_supported
: The list of the JWS signing algorithms (alg
values) supported
+id_token_signing_alg_values_supported
: The list of the JWS signing algorithms (alg
values) supported
issuer
: URL that the Data Holder asserts as its Issuer Identifier
jwks_uri
: The JSON Web Key Set for the data holder
registration_endpoint
: URL of the Client Registration End Point
-request_object_signing_alg_values_supported
: The list of the JWS signing algorithms (alg
values) supported for signing request objects.
+request_object_signing_alg_values_supported
: The list of the JWS signing algorithms (alg
values) supported for signing request objects.
response_modes_supported
: The list of the OAuth 2.0 response_mode
values supported
response_types_supported
: The list of the OAuth 2.0 response_type
values supported
scopes_supported
: The list of supported scopes
@@ -6523,9 +6497,6 @@ Authorisation End Point
-Replaced FAPI draft references with FAPI 1.0 Final references
-
-
The requirements for the Authorisation End Point are specified in section 3.3.2 of [OIDC] and further specified under section 5.2.2 of [FAPI-1.0-Advanced] . This end point is invoked as part of the Hybrid Authentication flow .
This endpoint does not require CORS .
@@ -6897,24 +6868,27 @@ CDR Arrangement Revocation End Poi
Data Holder's MUST use the Data Recipient Software Product's CDR Arrangement Revocation End Point with a valid cdr_arrangement_id
to notify the Data Recipient Software Product when consent is revoked by the consumer via the Data Holder.
-Pushed Authorisation End Point Updated non-normtative example to use RFC9126, not the draft PAR specification
-
+Pushed Authorisation End Point
+
Non-Normative Example
Utilising RFC9126 and OIDC Hybrid Flow
Request
+
POST /par HTTP/1.1
Host: data.holder.com.au
Content-Type: application/x-www-form-urlencoded
request=eyJhbGciOiJQUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6IjEyMyJ9.ey...
+
Decoded Request
This example shows an authorisation request using the OIDC Hybrid Flow
+
{
"iss": "s6BhdRkqt3",
"exp": 1516239322,
@@ -6942,9 +6916,11 @@ Pushed Authorisation End Point
+
Response
+
HTTP/1.1 201 Created
Content-Type: application/json
Cache-Control: no-cache, no-store
@@ -6953,9 +6929,11 @@ Pushed Authorisation End Point
+
Authorise
+
## The request_uri is used by the ADR in the subsequent authorisation request as follows
## (note this example is pre-RFC using Draft 01 of the PAR standard, hence it includes
## the mandatory oAuth parameters as per FAPI R/W for confidential clients must be
@@ -6968,24 +6946,27 @@ Pushed Authorisation End Point
+
Non-Normative Example - FAPI 1.0 Final Phase 3 Obligations
Utilising FAPI 1.0 Final, PAR RFC9126, PKCE, JARM and Authorization Code Flow
Request
+
POST /par HTTP/1.1
Host: data.holder.com.au
Content-Type: application/x-www-form-urlencoded
request=eyJhbGciOiJQUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6IjEyMyJ9.ey...
+
Decoded Request - FAPI 1.0 Final Phase 3 Obligation
This example shows an authorisation request using the Authorisation Code Flow (FAPI 1.0 migration Phase 3)
-+ Added "response_mode" to the non normative example. This demonstrates the use of Authorization Code Flow in conjunction with JARM and FAPI 1.0
-
{
+
+{
"iss": "s6BhdRkqt3",
"exp": 1680832800,
"nbf": 1680829200,
@@ -7016,9 +6997,11 @@ Pushed Authorisation End Point
+
Response - FAPI 1.0 Final Phase 3 Obligation
+
HTTP/1.1 201 Created
Content-Type: application/json
Cache-Control: no-cache, no-store
@@ -7027,9 +7010,11 @@ Pushed Authorisation End Point
+
Authorise - FAPI 1.0 Final Phase 3 Obligation
+
## This is used by the ADR in the subsequent authorisation request as follows
## (this example uses PAR RFC 9126 and Authorization Code Flow):
@@ -7038,9 +7023,11 @@ Pushed Authorisation End Point
+
Authorisation response using JARM response encryption - FAPI 1.0 Final Phase 3 Obligation
+
eyJraWQiOiIwZWQ3YTNkZi1hMGJlLTRhZjQtOTk0YS1jNDBhODc0ODQwNjMiLCJhbGciOiJQUzI1NiJ9.eyJhdWQiOiIxMjM0NSIsImNvZGUiOiJpMVdzUm4xdUIxIiwiaXNzIjoiaHR0cHM6Ly9kYXRhLmhvbGRlci5jb20uYXUvIiwic3RhdGUiOiJhZjBpZmpzbGRraiIsImV4cCI6MTY2NzI2ODAwMH0.flBD3bTUHUFiNMbfgt-Uqt4wnEFHY79QYx0f9qrqPGPZLB-RBb-F20aPTyB9XaJ1JJ3ie1m0YxdMC7t6aiXSchZZQXBmYpIjvlbTceOVBYlr88llqeLAfQ5nCDD4p2axqyedpA83OgPF8i_Ngw0oRsCwBTueo6C40wYeI3ZT_n0hucQqGHcSoR1im7IY1rY0x99EZjJI3pxVtGwst6e-msomipnYedCdkNuPHE_Rnj0g897zi_NdK6m3dhxcpwaoMXcaYfMkkkzTlbz5_Ic9lWMx_z01C2wRNjRBArEJsNXW0Q8Vdhk_vtOAmO92Pr3cI8BpTr5KdY2O1iD-yRnkug
## Decoded Response
@@ -7056,6 +7043,7 @@ Pushed Authorisation End Point
+
Description
@@ -7081,8 +7069,7 @@ Pushed Authorisation End Point
Data Holders MUST support Pushed Authorisation Requests (PAR) via the pushed authorisation end point according to [PAR] .
-- Removed legacy phasing requirements for FAPI 1.0 Final using PAR
-
+
Data Recipient Software Products MUST send authorisation requests using [PAR] if supported by the Data Holder.
The Data Holder response provides the Data Recipient Software Product with a Request URI in the response. The Request URI is then passed to the Data Holder’s Authorisation End Point to initiate an authorisation flow.
@@ -8593,9 +8580,7 @@ Base URLs:
https://secure.api.cdr.gov.au
-Amended the jwks and well known endpoint paths to reflect actual
-Register implementation
-
+
Get OpenId Provider Config
@@ -12487,11 +12472,6 @@ Traffic Thresholds
For Unattended traffic during high traffic periods only best effort support is required.
-Updated the static site wide TPS thresholds with a graduated set of
-thresholds depending on the number of active authorisations established
-with the data holder
-
-
For secure traffic (both Customer Present and Unattended) the following traffic thresholds will apply:
@@ -12523,9 +12503,9 @@ Data Recipient Requirements
Unattended calls should be managed to avoid short term bursts of traffic
-
+ Added the Low Velocity Data Sets section
-
Low Velocity Data Sets
-For endpoints that provide access to data that is low velocity (ie. the data does not change frequently) the Data Recipient Software Product is expected to cache the results of any data they receive and not request the same resource again until the data may reasonably have changed.
+Low Velocity Data Sets
+
+For endpoints that provide access to data that is low velocity (ie. the data does not change frequently) the Data Recipient Software Product is expected to cache the results of any data they receive and not request the same resource again until the data may reasonably have changed.
For low velocity data sets, if the same data is requested repeatedly a Data Holder may reject subsequent requests for the same data during a specified period.
@@ -12627,36 +12607,7 @@ Banking APIs
Banking OpenAPI Specification (JSON)
Banking OpenAPI Specification (YAML)
-Updated the versions of the following APIs:
-+ Get Scheduled Payments For Account from v1 to v2
-+ Get Scheduled Payments Bulk from v1 to v2
-+ Get Scheduled Payments For Specific Accounts from v1 to v2
-
-
-Updated the following structures
-from:
-- ResponseBankingScheduledPaymentsList
-- BankingScheduledPayment
-- BankingScheduledPaymentSet
-- BankingScheduledPaymentTo
-
-to:
-+ ResponseBankingScheduledPaymentsListV2
-+ BankingScheduledPaymentV2
-+ BankingScheduledPaymentSetV2
-+ BankingScheduledPaymentToV2
-
-Added the following to 'BankingScheduledPaymentToV2' structure:
-+ 'digitalWallet' ENUM value to the toUType field
-+ 'digitalWallet' object
-+ 'BankingDigitalWalletPayee' schema for 'digitalWallet' object
-
-Replaced FAPI draft references with FAPI 1.0 Final references.
-References pertain to the x-fapi-auth-date header.
-
-Typo correction for the Get Products API description, changing
-"actual" to "actually"
-
+
Get Accounts
@@ -25601,40 +25552,7 @@ Energy APIs
Energy OpenAPI Specification (JSON)
Energy OpenAPI Specification (YAML)
-Updated description of EnergyPaymentSchedule.digitalWallet.name field
-from:
-- The name assigned to the digital wallet by the owner of the wallet, else the display name provided by the digital wallet provider
- to:
-+ The display name of the wallet as given by the customer, else a default value defined by the data holder
-
-Updated description of `EnergyPaymentSchedule.isTokenised` field to further clarify when it can be used
-
-Updated the versions of the following APIs:
-+ Get Billing For Account from v1 to v2
-+ Get Bulk Billing from v1 to v2
-+ Get Billing For Specific Accounts from v1 to v2
-
-Updated the following structures
-from:
-- EnergyBillingListResponse
-- EnergyBillingTransaction
-- EnergyBillingDemandTransaction
-- EnergyBillingUsageTransaction
-
-to:
-+ EnergyBillingListResponseV2
-+ EnergyBillingTransactionV2
-+ EnergyBillingDemandTransactionV2
-+ EnergyBillingUsageTransactionV2
-
-
-Added following ENUM values to EnergyBillingDemandTransaction.timeOfUseType field:
-+ ALL_DAY
-+ EXCESS
-
-Added following ENUM values to EnergyBillingUsageTransaction.timeOfUseType field:
-+ ALL_DAY
-
+
Get Generic Plans
@@ -43515,9 +43433,7 @@ Common APIs
Common OpenAPI Specification (JSON)
Common OpenAPI Specification (YAML)
-Replaced FAPI draft references with FAPI 1.0 Final references.
-References pertain to the x-fapi-auth-date header.
-
+
Get Customer
@@ -46155,29 +46071,10 @@ Admin APIs
Admin OpenAPI Specification (JSON)
Admin OpenAPI Specification (YAML)
-+ Adding v4 and v5 of the Get Metrics endpoint
-
-v4 changes are:
-• Aligned types to standard CDR types
-• Separated availability and TPS metric into aggregated,
- authenticated and unauthenticed
-• Error counts split by HTTP error code
-• Added new authorisation metrics
-• Added language to clarify that metrics are calculated at
- the Data Holder brand level for Data Holders with multiple
- brands
-
-v5 changes are:
-• Performance metrics broken down by performance tier
-• Include hourly metrics for performance metrics to align to NFRs
-• Inclusion of aggregate metric for performance metrics
-• Addition of abandonmentsByStage object to authorisation metrics
-
-Note that two typos were identified in the initial version of
-1.25.0 published on 8th July that have now been corrected. These
-are:
-• Incorrect description of the ErrorMetricsV2 model
-• Incorrect name of the preIdentification field
+Modified the retirement date, and implementation requirements,
+for get Metrics v3
+
+Corrected the obligation date for Get Metrics v3
@@ -46384,15 +46281,15 @@ Get Metrics
This end point is not required to be implemented by the Australian Energy Market Operator, the Australian Energy Regulator or the Department of State administered by the Minister of Victoria administering the National Electricity (Victoria) Act 2005 (Vic).
-NOTE: This version must be implemented by June 13th 2024
+NOTE: This version MUST be implemented by May 13th 2024
Obsolete versions: v1 v2 .
Deprecated versions:
-v3
-v4 - This version, or v5, must be implemented by November 1st 2023
+v3 - Implementation not required for Data Holders going live on, or after, 1st November 2023. Other Data Holders MAY retire this version from the earlier of 13th May 2023 or from the time ACCC announce that they no longer call this version
+v4 - This version, or v5, MUST be implemented by November 1st 2023
If the Data Holder supports private_key_jwt client authentication they MUST validate the scope.
@@ -53954,7 +53851,9 @@ Experimental Standards
Known Issues
There are certain aspects of the standards that are actively under review. These known issues are articulated in the following table.
-
+The known issue related to the incorrect obligation date for
+Get Metrics v5 has been removed as it has been resolved
+
Issue
@@ -53962,10 +53861,6 @@ Known Issues
-Incorrect obligation date for Get Metrics v5
-The future dated obligation date has been incorrectly documented in the standards as June 13th 2024. This was a documentation error when v1.25.0 of the standards were published. According to the decision of the Data Standards Chair (Decision 288) the obligation date for the implementation of Get Metrics v5 is May 13th 2024 . This will be corrected in the next release of the standards.
-
-
Register APIs use local version of common definitions
The Register APIs use a locally defined version of common schema definitions such as ResponseErrorList
for error responses. These need to be updated to reference common swagger specifications inherited by the Common Swagger spec.
@@ -54033,6 +53928,12 @@ Change Log
+23/08/2023
+1.26.0
+Changes to obligations for the implementation of Get Metrics
+See release notes and Decision 322 for details.
+
+
08/07/2023
1.25.0
Changes arising from Decision 303 (Maintenance iteration 15) and Decision 288 (Metrics and NFRs)
@@ -54488,6 +54389,11 @@ Archives
+08/07/2023
+1.25.0
+Changes arising from Decision 303 (Maintenance iteration 15) and Decision 288 (Metrics and NFRs)
+
+
07/05/2023
1.24.0
Changes arising from Decision 281 (Maintenance iteration 14)
diff --git a/slate/source/includes/_admin.md.erb b/slate/source/includes/_admin.md.erb
index 6f34c9de..96650b37 100644
--- a/slate/source/includes/_admin.md.erb
+++ b/slate/source/includes/_admin.md.erb
@@ -10,29 +10,10 @@ This provides an overview of CDS Administration Endpoints. Please note this API
```diff
-+ Adding v4 and v5 of the Get Metrics endpoint
+Modified the retirement date, and implementation requirements,
+for get Metrics v3
-v4 changes are:
-• Aligned types to standard CDR types
-• Separated availability and TPS metric into aggregated,
- authenticated and unauthenticed
-• Error counts split by HTTP error code
-• Added new authorisation metrics
-• Added language to clarify that metrics are calculated at
- the Data Holder brand level for Data Holders with multiple
- brands
-
-v5 changes are:
-• Performance metrics broken down by performance tier
-• Include hourly metrics for performance metrics to align to NFRs
-• Inclusion of aggregate metric for performance metrics
-• Addition of abandonmentsByStage object to authorisation metrics
-
-Note that two typos were identified in the initial version of
-1.25.0 published on 8th July that have now been corrected. These
-are:
-• Incorrect description of the ErrorMetricsV2 model
-• Incorrect name of the preIdentification field
+Corrected the obligation date for Get Metrics v3
```
<%= partial "includes/cds_admin.md" %>
diff --git a/slate/source/includes/_banking_apis.md.erb b/slate/source/includes/_banking_apis.md.erb
index d0593887..6ffeea82 100644
--- a/slate/source/includes/_banking_apis.md.erb
+++ b/slate/source/includes/_banking_apis.md.erb
@@ -10,38 +10,6 @@ This specification defines the APIs for Data Holders exposing Banking endpoints.
Banking OpenAPI Specification (YAML)
-```diff
-Updated the versions of the following APIs:
-+ Get Scheduled Payments For Account from v1 to v2
-+ Get Scheduled Payments Bulk from v1 to v2
-+ Get Scheduled Payments For Specific Accounts from v1 to v2
-
-
-Updated the following structures
-from:
-- ResponseBankingScheduledPaymentsList
-- BankingScheduledPayment
-- BankingScheduledPaymentSet
-- BankingScheduledPaymentTo
-
-to:
-+ ResponseBankingScheduledPaymentsListV2
-+ BankingScheduledPaymentV2
-+ BankingScheduledPaymentSetV2
-+ BankingScheduledPaymentToV2
-
-Added the following to 'BankingScheduledPaymentToV2' structure:
-+ 'digitalWallet' ENUM value to the toUType field
-+ 'digitalWallet' object
-+ 'BankingDigitalWalletPayee' schema for 'digitalWallet' object
-
-Replaced FAPI draft references with FAPI 1.0 Final references.
-References pertain to the x-fapi-auth-date header.
-
-Typo correction for the Get Products API description, changing
-"actual" to "actually"
-```
-
<%= partial "includes/cds_banking.md" %>
<%= partial "includes/banking/_product_categories.md" %>
<%= partial "includes/banking/_product_components.md" %>
diff --git a/slate/source/includes/_common_apis.md.erb b/slate/source/includes/_common_apis.md.erb
index 563569ad..3ec560c3 100644
--- a/slate/source/includes/_common_apis.md.erb
+++ b/slate/source/includes/_common_apis.md.erb
@@ -8,8 +8,4 @@ This specification defines the Common APIs that apply to Data Holders multiple s
Common OpenAPI Specification (YAML)
-```diff
-Replaced FAPI draft references with FAPI 1.0 Final references.
-References pertain to the x-fapi-auth-date header.
-```
<%= partial "includes/cds_common.md" %>
diff --git a/slate/source/includes/_energy_apis.md.erb b/slate/source/includes/_energy_apis.md.erb
index eac47e30..223aa56a 100644
--- a/slate/source/includes/_energy_apis.md.erb
+++ b/slate/source/includes/_energy_apis.md.erb
@@ -8,40 +8,4 @@ This specification defines the APIs for Data Holders exposing Energy endpoints.
Energy OpenAPI Specification (YAML)
-```diff
-Updated description of EnergyPaymentSchedule.digitalWallet.name field
-from:
-- The name assigned to the digital wallet by the owner of the wallet, else the display name provided by the digital wallet provider
-to:
-+ The display name of the wallet as given by the customer, else a default value defined by the data holder
-
-Updated description of `EnergyPaymentSchedule.isTokenised` field to further clarify when it can be used
-
-Updated the versions of the following APIs:
-+ Get Billing For Account from v1 to v2
-+ Get Bulk Billing from v1 to v2
-+ Get Billing For Specific Accounts from v1 to v2
-
-Updated the following structures
-from:
-- EnergyBillingListResponse
-- EnergyBillingTransaction
-- EnergyBillingDemandTransaction
-- EnergyBillingUsageTransaction
-
-to:
-+ EnergyBillingListResponseV2
-+ EnergyBillingTransactionV2
-+ EnergyBillingDemandTransactionV2
-+ EnergyBillingUsageTransactionV2
-
-
-Added following ENUM values to EnergyBillingDemandTransaction.timeOfUseType field:
-+ ALL_DAY
-+ EXCESS
-
-Added following ENUM values to EnergyBillingUsageTransaction.timeOfUseType field:
-+ ALL_DAY
-```
-
<%= partial "includes/cds_energy.md" %>
diff --git a/slate/source/includes/_register.md.erb b/slate/source/includes/_register.md.erb
index 49879b52..e2f8f7c4 100644
--- a/slate/source/includes/_register.md.erb
+++ b/slate/source/includes/_register.md.erb
@@ -38,9 +38,4 @@ These endpoints are exposed by the Register and consumed by Data Holders and Dat
|**Production TLS**|https://api.cdr.gov.au|
|**Production mTLS**|https://secure.api.cdr.gov.au|
-```diff
-Amended the jwks and well known endpoint paths to reflect actual
-Register implementation
-```
-
<%= partial "includes/cds_register.md" %>
diff --git a/slate/source/includes/additional/candidates/telco_apis.md b/slate/source/includes/additional/candidates/telco_apis.md
index 364daf31..aefb3fe5 100644
--- a/slate/source/includes/additional/candidates/telco_apis.md
+++ b/slate/source/includes/additional/candidates/telco_apis.md
@@ -4,14 +4,3 @@ This specification defines the APIs for Data Holders exposing Telecommunications
Telco OpenAPI Specification (JSON)
Telco OpenAPI Specification (YAML)
-
-```diff
-Updated description of TelcoPaymentScheduleDigitalWallet.name field
-from:
-- The name assigned to the digital wallet by the owner of the wallet, else the display name provided by the digital wallet provider
-to:
-+ The display name of the wallet as given by the customer, else a default value defined by the data holder
-
-Replaced FAPI draft references with FAPI 1.0 Final references.
-References pertain to the x-fapi-auth-date header.
-```
diff --git a/slate/source/includes/archives.md b/slate/source/includes/archives.md
index 529e3389..3a6a76cc 100644
--- a/slate/source/includes/archives.md
+++ b/slate/source/includes/archives.md
@@ -4,6 +4,7 @@ The following table lists archived versions of the Consumer Data Standards. The
|Releases Date|Version|Description|
|-------------|-------|-----------|
+|08/07/2023 |1.25.0|Changes arising from Decision 303 (Maintenance iteration 15) and Decision 288 (Metrics and NFRs) |
|07/05/2023 |1.24.0|Changes arising from Decision 281 (Maintenance iteration 14) |
|24/04/2023 |1.23.0|Changes arising from Decision Proposal 298 |
|22/03/2023 |1.22.1|Patch release including updates to draft Telco standards |
diff --git a/slate/source/includes/cds_admin.md b/slate/source/includes/cds_admin.md
index eea960a2..adf6ae4a 100644
--- a/slate/source/includes/cds_admin.md
+++ b/slate/source/includes/cds_admin.md
@@ -145,14 +145,14 @@ This end point allows the ACCC to obtain operational statistics from the Data Ho
This end point is not required to be implemented by the Australian Energy Market Operator, the Australian Energy Regulator or the Department of State administered by the Minister of Victoria administering the National Electricity (Victoria) Act 2005 (Vic).
-NOTE: This version must be implemented by **June 13th 2024**
+NOTE: This version **MUST** be implemented by **May 13th 2024**
Obsolete versions: [v1](includes/obsolete/get-metrics-v1.html) [v2](includes/obsolete/get-metrics-v2.html).
Deprecated versions:
-- [v3](includes/obsolete/get-metrics-v3.html)
-- [v4](includes/obsolete/get-metrics-v4.html) - This version, or v5, must be implemented by **November 1st 2023**
+- [v3](includes/obsolete/get-metrics-v3.html) - Implementation not required for Data Holders going live on, or after, 1st November 2023. Other Data Holders **MAY** retire this version from the earlier of **13th May 2023** or from the time ACCC announce that they no longer call this version
+- [v4](includes/obsolete/get-metrics-v4.html) - This version, or v5, **MUST** be implemented by **November 1st 2023**
If the Data Holder supports private_key_jwt client authentication they MUST validate the scope.
diff --git a/slate/source/includes/changelog.md b/slate/source/includes/changelog.md
index b57070fa..4d5f5f62 100644
--- a/slate/source/includes/changelog.md
+++ b/slate/source/includes/changelog.md
@@ -4,6 +4,7 @@ The following table lists the changes made to these standards in reverse date or
|Change Date|Version|Description|Detail Of change|
|-----------|-------|-----------|----------------|
+|23/08/2023| 1.26.0 | Changes to obligations for the implementation of Get Metrics | See [release notes](includes/releasenotes/releasenotes.1.26.0.html) and [Decision 322](https://github.com/ConsumerDataStandardsAustralia/standards/issues/322) for details. |
|08/07/2023| 1.25.0 | Changes arising from Decision 303 (Maintenance iteration 15) and Decision 288 (Metrics and NFRs) | See [release notes](includes/releasenotes/releasenotes.1.25.0.html), [Decision 303](https://github.com/ConsumerDataStandardsAustralia/standards/issues/303) and [Decision 288](https://github.com/ConsumerDataStandardsAustralia/standards/issues/288) for details. |
|07/05/2023| 1.24.0 | Changes arising from Decision 281 (Maintenance iteration 14) | See [release notes](includes/releasenotes/releasenotes.1.24.0.html) and [Decision 281](https://github.com/ConsumerDataStandardsAustralia/standards/issues/281) for details. |
|14/04/2023| 1.23.0 | Changes arising from Decision Proposal 298 | See [release notes](includes/releasenotes/releasenotes.1.23.0.html) and [Decision 298](https://github.com/ConsumerDataStandardsAustralia/standards/issues/298) for details. |
diff --git a/slate/source/includes/endpoint-version-schedule/includes/_common-dh.md b/slate/source/includes/endpoint-version-schedule/includes/_common-dh.md
index 97d52cd6..d1bd92ac 100644
--- a/slate/source/includes/endpoint-version-schedule/includes/_common-dh.md
+++ b/slate/source/includes/endpoint-version-schedule/includes/_common-dh.md
@@ -23,6 +23,11 @@
| Admin APIs | Metadata Update | ``/admin/register/metadata`` | POST | V1 | 2020-07-01 | N/A | 2019-09-30, V1.0.0 | N/A |
| Admin APIs | Get Metrics | ``/admin/metrics`` | GET | V1 | 2020-07-01 | 2021-10-31 | 2019-09-30, V1.0.0 | 2021-04-29, V1.9.0 |
| Admin APIs | Get Metrics | ``/admin/metrics`` | GET | V2 | 2021-07-31 | 2022-12-05 | 2020-09-16, V1.5.0 | 2021-10-06, V1.12.0 |
-| Admin APIs | Get Metrics | ``/admin/metrics`` | GET | V3 | 2022-10-01 | N/A | 2021-10-06, V1.12.0 | N/A |
-| Admin APIs | Get Metrics | ``/admin/metrics`` | GET | V4 | 2023-11-01 | When v5 Implemented | 2023-07-08, V1.25.0 | N/A |
-| Admin APIs | Get Metrics | ``/admin/metrics`` | GET | V5 | 2024-06-13 | N/A | 2023-07-08, V1.25.0 | N/A |
+| Admin APIs | Get Metrics | ``/admin/metrics`` | GET | V3 | 2022-10-01 | 2024-05-13 **†** | 2021-10-06, V1.12.0 | 2023-07-08, V1.25.0 |
+| Admin APIs | Get Metrics | ``/admin/metrics`` | GET | V4 | 2023-11-01 | When v5 Implemented | 2023-07-08, V1.25.0 | 2023-07-08, V1.25.0 |
+| Admin APIs | Get Metrics | ``/admin/metrics`` | GET | V5 | 2024-05-13 | N/A | 2023-07-08, V1.25.0 | N/A |
+
+**†NOTE:** the details of the retirement date for Get Metrics v3 is as follows:
+
+* Implementation of Get Metrics v3 is not required for Data Holders going live on, or after, 1st November 2023
+* Other Data Holders **MAY** retire this version from the earlier of **13th May 2023** or from the time ACCC announce that they no longer call this version
diff --git a/slate/source/includes/introduction/_dependencies_schedule.md b/slate/source/includes/introduction/_dependencies_schedule.md
index 0f34bdbf..8203c6da 100644
--- a/slate/source/includes/introduction/_dependencies_schedule.md
+++ b/slate/source/includes/introduction/_dependencies_schedule.md
@@ -1,10 +1,5 @@
## Register Implementation Schedule
-```diff
-Removed the dependency schedule content for the Register APIs
-and linked to the ACCC implementation schedule.
-```
-
The implementation of the Register APIs is managed by the ACCC.
Their implementation schedule is [published here](https://consumerdataright.atlassian.net/wiki/spaces/DP/pages/30081043/Delivery+Dates).
diff --git a/slate/source/includes/introduction/_fdo.md b/slate/source/includes/introduction/_fdo.md
index 73062a98..1284e3cd 100644
--- a/slate/source/includes/introduction/_fdo.md
+++ b/slate/source/includes/introduction/_fdo.md
@@ -5,17 +5,19 @@ The standards, as published from time to time, may include specific statements i
The table below highlights these areas of the standards.
```diff
-Removed legacy obligation dates more than 6 months in the past
-Fixed spelling of "Register"
+Added the retirement details for Get Metrics v3
-Added FDOs for decision 288 and 303
+Corrected the obligation date for Get Metrics v5
+
+Replaced the term `obsolete` with `retire` to clarify the
+intent of these statements
```
|Section|Description|Applicable Date|
|-------|-----------|---------------|
-|[Get Account Detail V1](#get-account-detail)|Data holders **MAY** obsolete version 1 of this end point from February 28th 2023. Data recipients **MUST** upgrade their implementations to use version 2 by this time|February 28th 2023|
-|[Get Product Detail V3](#get-product-detail)|Data holders **MAY** obsolete version 3 of this end point from February 28th 2023. Data recipients **MUST** upgrade their implementations to use version 4 by this time|February 28th 2023|
-|[Get Customer Detail V1](#get-customer-detail)|Data holders **MAY** obsolete version 1 of this end point from February 28th 2023. Data recipients **MUST** upgrade their implementations to use version 2 by this time|February 28th 2023|
+|[Get Account Detail V1](#get-account-detail)|Data holders **MAY** retire version 1 of this end point from February 28th 2023. Data recipients **MUST** upgrade their implementations to use version 2 by this time|February 28th 2023|
+|[Get Product Detail V3](#get-product-detail)|Data holders **MAY** retire version 3 of this end point from February 28th 2023. Data recipients **MUST** upgrade their implementations to use version 4 by this time|February 28th 2023|
+|[Get Customer Detail V1](#get-customer-detail)|Data holders **MAY** retire version 1 of this end point from February 28th 2023. Data recipients **MUST** upgrade their implementations to use version 2 by this time|February 28th 2023|
|[Get Energy Accounts V2](#get-energy-accounts)|Data Holders **MUST** implement v2 of this endpoint by **April 14th 2023** | April 14th 2023 |
|[Get Energy Account Detail V2](#get-energy-account-detail)|Data Holders **MUST** implement v2 of this endpoint by **April 14th 2023** | April 14th 2023 |
|[Information Security profile](#security-profile) | FAPI 1.0 adoption is introduced across four phases.Phase 3: Support Authorization Code Flow and Hybrid Flow includes, amongst other changes:Data Holders **MUST** support Authorization Code Flow Data Holders **MUST** support Hybrid Flow | April 14th 2023 |
@@ -23,16 +25,17 @@ Added FDOs for decision 288 and 303
|[Information Security profile](#security-profile) | FAPI 1.0 adoption is introduced across four phases.Phase 4: Retire Hybrid Flow :Data Holders **MAY** retire Hybrid Flow | July 10th 2023 |
|[Get Accounts V2](#get-accounts)|Version 2 of this end point **MUST** be made available by affected data holders by July 10th 2023|July 10th 2023|
|[Get Account Detail V3](#get-account-detail)|Version 3 of this end point **MUST** be made available by affected data holders by July 10th 2023|July 10th 2023|
-|[Get Generic Plan Detail V2](#get-generic-plan-detail)|Data Holders **MUST** implement v2 of this endpoint by **November 1st 2023** Data Holders **MAY** obsolete v1 of this endpoint from **September 9th 2024** | November 1st 2023 |
-|[Get Energy Account Detail V3](#get-account-detail)|Data Holders **MUST** implement v3 of this endpoint by **November 1st 2023** Data Holders **MAY** obsolete v2 of this endpoint from **September 9th 2024** | November 1st 2023 |
-|[Get Billing For Account V2](#get-billing-for-account)|Data Holders **MUST** implement v2 of this endpoint by **November 1st 2023** Data Holders **MAY** obsolete v1 of this endpoint from **September 9th 2024** | November 1st 2023 |
-|[Get Bulk Billing V2](#get-bulk-billing)|Data Holders **MUST** implement v2 of this endpoint by **November 1st 2023** Data Holders **MAY** obsolete v1 of this endpoint from **September 9th 2024** | November 1st 2023 |
-|[Get Billing For Specific Accounts V2](#get-billing-for-specific-accounts)|Data Holders **MUST** implement v2 of this endpoint by **November 1st 2023** Data Holders **MAY** obsolete v1 of this endpoint from **September 9th 2024** | November 1st 2023 |
-|[Get Metrics V4](#get-metrics)|Data Holders **MUST** implement v4 or V5 of this endpoint by **November 1st 2023** Data Holders **MAY** deprecate v4 of this endpoint once V5 is implemented** | November 1st 2023 |
+|[Get Generic Plan Detail V2](#get-generic-plan-detail)|Data Holders **MUST** implement v2 of this endpoint by **November 1st 2023** Data Holders **MAY** retire v1 of this endpoint from **September 9th 2024** | November 1st 2023 |
+|[Get Energy Account Detail V3](#get-account-detail)|Data Holders **MUST** implement v3 of this endpoint by **November 1st 2023** Data Holders **MAY** retire v2 of this endpoint from **September 9th 2024** | November 1st 2023 |
+|[Get Billing For Account V2](#get-billing-for-account)|Data Holders **MUST** implement v2 of this endpoint by **November 1st 2023** Data Holders **MAY** retire v1 of this endpoint from **September 9th 2024** | November 1st 2023 |
+|[Get Bulk Billing V2](#get-bulk-billing)|Data Holders **MUST** implement v2 of this endpoint by **November 1st 2023** Data Holders **MAY** retire v1 of this endpoint from **September 9th 2024** | November 1st 2023 |
+|[Get Billing For Specific Accounts V2](#get-billing-for-specific-accounts)|Data Holders **MUST** implement v2 of this endpoint by **November 1st 2023** Data Holders **MAY** retire v1 of this endpoint from **September 9th 2024** | November 1st 2023 |
+|[Get Metrics V4](#get-metrics)|Data Holders **MUST** implement v4 or V5 of this endpoint by **November 1st 2023** Data Holders **MAY** retire v4 of this endpoint once V5 is implemented | November 1st 2023 |
|[Private Key JWT Client Authentication](https://consumerdatastandardsaustralia.github.io/standards/?examples#client-authentication) | Change to support [**[RFC7521]**](#nref-RFC7521) such that, until November 13th 2023, clients authenticating using Private Key JWT are _recommended_ to provide the `client_id`, but no longer required. From November 13th 2023, it is then _optional_ to provide the `client_id`. This applies to ADRs and the CDR Register authenticating with Data Holders and ADRs authenticating with the CDR Register. | November 13th 2023 |
|[Get Accounts V1](#get-account-detail)|Data Holders **MAY** decommission v1 of this end point from March 11th 2024| March 11th 2024 |
|[Get Account Detail V2](#get-account-detail)|Data Holders **MAY** decommission v2 of this end point from March 11th 2024| March 11th 2024 |
-|[Get Scheduled Payments for Account V2](#get-scheduled-payments-for-account)|Data Holders **MUST** implement v2 of this endpoint by **March 11th 2024** Data Holders **MAY** obsolete v1 of this endpoint from **September 9th 2024** | March 11th 2024 |
-|[Get Scheduled Payments Bulk V2](#get-scheduled-payments-bulk)|Data Holders **MUST** implement v2 of this endpoint by **March 11th 2024** Data Holders **MAY** obsolete v1 of this endpoint from **September 9th 2024** | March 11th 2024 |
-|[Get Scheduled Payments For Specific Accounts V2](#get-scheduled-payments-for-specific-accounts)|Data Holders **MUST** implement v2 of this endpoint by **March 11th 2024** Data Holders **MAY** obsolete v1 of this endpoint from **September 9th 2024** | March 11th 2024 |
-|[Get Metrics V5](#get-metrics)|Data Holders **MUST** implement V5 of this endpoint by **June 13th 2024** Data Holders **MAY** deprecate v4 of this endpoint once V5 is implemented** | June 13th 2024 |
+|[Get Scheduled Payments for Account V2](#get-scheduled-payments-for-account)|Data Holders **MUST** implement v2 of this endpoint by **March 11th 2024** Data Holders **MAY** retire v1 of this endpoint from **September 9th 2024** | March 11th 2024 |
+|[Get Scheduled Payments Bulk V2](#get-scheduled-payments-bulk)|Data Holders **MUST** implement v2 of this endpoint by **March 11th 2024** Data Holders **MAY** retire v1 of this endpoint from **September 9th 2024** | March 11th 2024 |
+|[Get Scheduled Payments For Specific Accounts V2](#get-scheduled-payments-for-specific-accounts)|Data Holders **MUST** implement v2 of this endpoint by **March 11th 2024** Data Holders **MAY** retire v1 of this endpoint from **September 9th 2024** | March 11th 2024 |
+|[Get Metrics V3](#get-metrics)|Data Holders **MAY** retire v3 of this endpoint by the earlier of **13th May 2024** or when the ACCC announce that this version is no longer being called Data Holders going live on, or after, 1st November 2023 are not required to support this version | May 13th 2024 |
+|[Get Metrics V5](#get-metrics)|Data Holders **MUST** implement v5 of this endpoint by **May 13th 2024** Data Holders **MAY** deprecate v4 of this endpoint once V5 is implemented | May 13th 2024 |
diff --git a/slate/source/includes/introduction/_intro.md b/slate/source/includes/introduction/_intro.md
index 63c76a2e..721caf3c 100644
--- a/slate/source/includes/introduction/_intro.md
+++ b/slate/source/includes/introduction/_intro.md
@@ -24,7 +24,7 @@ Some of these standards will be binding data standards under the Competition and
## Version
-These standards represent version 1.25.0 of the high level standards. See the [versioning section](#versioning) for more information on how versions are managed in the standard.
+These standards represent version 1.26.0 of the high level standards. See the [versioning section](#versioning) for more information on how versions are managed in the standard.
## Interpretation
diff --git a/slate/source/includes/introduction/_references.md b/slate/source/includes/introduction/_references.md
index dce5e536..20b61c70 100644
--- a/slate/source/includes/introduction/_references.md
+++ b/slate/source/includes/introduction/_references.md
@@ -1,13 +1,5 @@
## Normative References
-```diff
-Removed legacy FAPI references:
-- FAPI-R-Draft
-- FAPI-RW-Draft
-
-Updated PAR references to refer to RFC9126
-```
-
| **Reference** | **Description** | **Version** |
| --- | --- | --- |
| **[DCR]** | OAuth 2.0 Dynamic Client Registration Protocol: |Jul 2015
diff --git a/slate/source/includes/known-issues.md b/slate/source/includes/known-issues.md
index 1dd4d68e..5d5118db 100644
--- a/slate/source/includes/known-issues.md
+++ b/slate/source/includes/known-issues.md
@@ -2,9 +2,13 @@
There are certain aspects of the standards that are actively under review. These known issues are articulated in the following table.
+```diff
+The known issue related to the incorrect obligation date for
+Get Metrics v5 has been removed as it has been resolved
+```
+
Issue | Description
:---- | :----------
-Incorrect obligation date for Get Metrics v5 | The future dated obligation date has been incorrectly documented in the standards as June 13th 2024. This was a documentation error when v1.25.0 of the standards were published. According to the decision of the Data Standards Chair (Decision 288) the obligation date for the implementation of Get Metrics v5 is **May 13th 2024**. This will be corrected in the next release of the standards.
Register APIs use local version of common definitions | The Register APIs use a locally defined version of common schema definitions such as `ResponseErrorList` for error responses. These need to be updated to reference common swagger specifications inherited by the Common Swagger spec.
Register APIs use different field type definitions | The Register APIs define their own field types that are not consistent with the [Common Field Types](#common-field-types) defined in the data standards. As part of porting the Register standards across to the primary data standards, the field types need to be re-aligned to use the common field type definitions. For example, `string (data-time)` should be changed to `DataTime` and `integer(int32)` should be changed to `PositiveInteger`.
DCR and Register Swagger naming conventions | The DCR and Register naming conventions are not consistent with the broader data standards. Field names should be standardised to camelCase and snake_case inline with the data standards
diff --git a/slate/source/includes/nfrs/_data-recipient-requirements.md b/slate/source/includes/nfrs/_data-recipient-requirements.md
index b7feeb7b..e315496b 100644
--- a/slate/source/includes/nfrs/_data-recipient-requirements.md
+++ b/slate/source/includes/nfrs/_data-recipient-requirements.md
@@ -6,10 +6,6 @@ Data Recipient Software Products will be limited by the traffic thresholds docum
- Services should schedule unattended calls to avoid high traffic periods
- Unattended calls should be managed to avoid short term bursts of traffic
-```diff
-+ Added the Low Velocity Data Sets section
-```
-
### Low Velocity Data Sets
For endpoints that provide access to data that is low velocity (ie. the data does not change frequently) the Data Recipient Software Product is expected to cache the results of any data they receive and not request the same resource again until the data may reasonably have changed.
diff --git a/slate/source/includes/nfrs/_traffic-thresholds.md b/slate/source/includes/nfrs/_traffic-thresholds.md
index 054f01b3..8fe719cf 100644
--- a/slate/source/includes/nfrs/_traffic-thresholds.md
+++ b/slate/source/includes/nfrs/_traffic-thresholds.md
@@ -22,11 +22,6 @@ For Unattended traffic the following traffic thresholds will apply for low traff
For Unattended traffic during high traffic periods only best effort support is required.
-```diff
-Updated the static site wide TPS thresholds with a graduated set of
-thresholds depending on the number of active authorisations established
-with the data holder
-```
For secure traffic (both Customer Present and Unattended) the following traffic thresholds will apply:
- For Data Holders with 0 to 10,000 active authorisations, 150 peak TPS total across all consumers
diff --git a/slate/source/includes/obsolete/get-metrics-v3.html.md b/slate/source/includes/obsolete/get-metrics-v3.html.md
index a91ffa9a..9d799abf 100644
--- a/slate/source/includes/obsolete/get-metrics-v3.html.md
+++ b/slate/source/includes/obsolete/get-metrics-v3.html.md
@@ -13,7 +13,9 @@ search: false
# Get Metrics V3
This page documents the deprecated version 3 of the Get Metrics end point.
-This version does not yet have an obsolescence date and must continue to be supported by data holders.
+Support for this version is not required for Data Holders going live on, or after, 1st November 2023.
+
+Other Data Holders **MAY** retire this version from the earlier of **13th May 2023** or from the time ACCC announce that they no longer call this version.
## Get Metrics
diff --git a/slate/source/includes/obsolete/get-metrics-v4.html.md b/slate/source/includes/obsolete/get-metrics-v4.html.md
index f7cefb26..67b6bd81 100644
--- a/slate/source/includes/obsolete/get-metrics-v4.html.md
+++ b/slate/source/includes/obsolete/get-metrics-v4.html.md
@@ -13,7 +13,7 @@ search: false
# Get Metrics V4
This page documents the deprecated version 4 of the Get Metrics end point.
-This version must be implemented by **November 1st 2023** and may be obsoleted once v5 has been implemented
+This version **MUST** be implemented by **November 1st 2023** and **MAY** be retured once v5 has been implemented
## Get Metrics
diff --git a/slate/source/includes/releasenotes/releasenotes.1.26.0.html.md b/slate/source/includes/releasenotes/releasenotes.1.26.0.html.md
new file mode 100644
index 00000000..10b2b9df
--- /dev/null
+++ b/slate/source/includes/releasenotes/releasenotes.1.26.0.html.md
@@ -0,0 +1,64 @@
+---
+title: Consumer Data Standards - v1.26.0 Release Notes
+
+#language_tabs: # must be one of https://git.io/vQNgJ
+
+toc_footers:
+ - Consumer Data Standards
+
+search: false
+---
+
+# V1.26.0 Release Notes
+Release notes for version v1.26.0 of the [CDR Standards](../../index.html).
+
+## Changes Made
+### Change Requests
+
+This release addresses the following minor defects raised on [Standards Staging](https://github.com/ConsumerDataStandardsAustralia/standards-staging/issues):
+
+- TBD
+
+This release addresses the following change requests raised on [Standards Maintenance](https://github.com/ConsumerDataStandardsAustralia/standards-maintenance/issues):
+
+- None
+
+### Decision Proposals
+
+This release addresses the following Decision Proposals published on [Standards](https://github.com/ConsumerDataStandardsAustralia/standards/issues):
+
+- [Decision Proposal 322 - Update Get Metrics Endpoint Schedule](https://github.com/ConsumerDataStandardsAustralia/standards/issues/322)
+
+## Introduction
+
+No Change
+
+## High Level Standards
+
+No Change
+
+## API End Points
+
+|Change|Description|Link|
+|------|-----------|----|
+| Modified Get Metrics Obligations | Changes to the obligation dates for Get Metrics v3 as determined in [Decision 322](https://github.com/ConsumerDataStandardsAustralia/standards/issues/322) | [Admin APIs](../../#admin-apis) |
+
+## Information Security Profile
+
+No Change
+
+## Register Standards
+
+No Change
+
+## Consumer Experience
+
+No Change
+
+## Non Functional Requirements
+
+No Change
+
+## Known Issues
+
+Resolved the known issue related to the incorrect obligation date for Get Metrics v5
diff --git a/slate/source/includes/security/_authentication_flows.md b/slate/source/includes/security/_authentication_flows.md
index 3da6b18e..34414d98 100644
--- a/slate/source/includes/security/_authentication_flows.md
+++ b/slate/source/includes/security/_authentication_flows.md
@@ -34,9 +34,6 @@ In line with CDR Rule 4.24 on restrictions when asking CDR consumers to authoris
- offering additional or alternative services
- reference or inclusion of other documents
-```diff
-Removed legacy phasing requirements for FAPI 1.0 Final
-```
* Data Holders **MUST** support FAPI 1.0 Advanced Profile (**[[FAPI-1.0-Advanced]](#nref-FAPI-1-0-Advanced)**).
* Data Holders **MUST** support Authorization Code Flow.
* Data Holders **MUST** support the OIDC Hybrid Flow.
@@ -52,10 +49,6 @@ The following statements are applicable to both the OIDC Hybrid Flow and Authori
- Data Recipient Software Products **SHOULD** record the following information each time an authorisation flow is executed: username (consumer’s ID at the Data Recipient Software Product), timestamp, IP, consent scopes and duration.
-```diff
-Removed legacy phasing requirements for FAPI 1.0 Final
-```
-
* Data Recipient Software Products **SHOULD NOT** reuse "authorization_code" values, and if reused, it will be rejected.
* Data Recipient Software Products **MAY** send requests with a "x-fapi-customer-ip-address" header containing a valid IPv4 or IPv6 address.
* Data Recipient Software Products **MUST** support FAPI 1.0 Advanced Profile (**[[FAPI-1.0-Advanced]](#nref-FAPI-1-0-Advanced)**).
diff --git a/slate/source/includes/security/_client_registration.md.erb b/slate/source/includes/security/_client_registration.md.erb
index 821f614d..b9c31840 100644
--- a/slate/source/includes/security/_client_registration.md.erb
+++ b/slate/source/includes/security/_client_registration.md.erb
@@ -8,10 +8,6 @@ Data Recipients register with Data Holders according to **[[DCR]](#nref-DCR)** t
As per **[[DCR]](#nref-DCR)**, a Software Statement is defined in as: _A digitally signed JSON Web Token (JWT) created in accordance with **[[JWT]](#nref-JWT)** that asserts metadata values about the client software_
> An SSA is a digitally signed JSON Web Token (JWT) created in accordance with **[[JWT]](#nref-JWT)** that asserts metadata values about the client software.
-```diff
-Replaced FAPI draft references with FAPI 1.0 Final references
-```
-
Such that:
* The CDR Register **MUST** issue Software Statements to **active** Data Recipients for **active** Software Products
@@ -232,9 +228,6 @@ Accept: application/json
}
```
-```diff
-Replaced FAPI draft references with FAPI 1.0 Final references
-```
To register with a Data Holder, the Data Recipient sends an HTTP POST to the Data Holder registration endpoint.
* The request **MUST** be presented in the format of a **[[RFC7519]](#nref-RFC7519)** compliant JWT.
@@ -243,10 +236,6 @@ To register with a Data Holder, the Data Recipient sends an HTTP POST to the Dat
The client registration request **MUST** contain the following claims in the JWT payload unless designated as Optional:
-```diff
-Replaced FAPI draft references with FAPI 1.0 Final references
-```
-
| Claim | Required | Description
|--------------|-------|-----------------------------------------------------------------------------------------------
|**iss**| Required | Contains the identifier for the Data Recipient Software Product (SoftwareProductId) as defined in the CDR Register
@@ -284,10 +273,6 @@ Data Holders **MUST** support at a minimum, 1 algorithm for each claim.
Data Recipients **MUST** support all the algorithms used in the ecosystem to ensure they can communicate with all Data Holders.
-```diff
-Replaced FAPI draft references with FAPI 1.0 Final references
-```
-
ID Token algorithm considerations remain relevant where the OIDC Hybrid Flow is leveraged as defined in the Consumer Data Standards and in accordance with sections [5.1.1](https://openid.net/specs/openid-financial-api-part-2-1_0.html#id-token-as-detached-signature), [5.2.2.1](https://openid.net/specs/openid-financial-api-part-2-1_0.html#id-token-as-detached-signature-1), and [5.2.3.1](https://openid.net/specs/openid-financial-api-part-2-1_0.html#id-token-as-detached-signature-2) of **[[FAPI-1.0-Advanced]](#nref-FAPI-1-0-Advanced)**.
#### JARM Response Encryption Considerations
diff --git a/slate/source/includes/security/_overview.md b/slate/source/includes/security/_overview.md
index 674447bd..11eb767b 100644
--- a/slate/source/includes/security/_overview.md
+++ b/slate/source/includes/security/_overview.md
@@ -1,16 +1,11 @@
## Overview
-
-```diff
-Removed legacy phasing of FAPI draft specifications. Only FAPI 1.0 Final is relied upon.
-```
This information security profile builds upon the foundations of the [Financial-grade API Advanced Profile](https://openid.net/specs/openid-financial-api-part-2-1_0.html) **[[FAPI-1.0-Advanced]](#nref-FAPI-1-0-Advanced)** and other standards relating to
[Open ID Connect 1.0](http://openid.net/specs/openid-connect-core-1_0.html) **[[OIDC]](#nref-OIDC)**.
For information on the specific normative references that underpin this profile refer to the [Normative References section](#normative-references).
-
### Symbols and Abbreviated terms
- **API**: Application Programming Interface
- **CA**: Certificate Authority
diff --git a/slate/source/includes/security/_request_object.md b/slate/source/includes/security/_request_object.md
index fc5f162a..f06776f6 100644
--- a/slate/source/includes/security/_request_object.md
+++ b/slate/source/includes/security/_request_object.md
@@ -36,10 +36,6 @@
> Non-Normative Example - FAPI 1.0 Final Phase 3 Obligation
-```diff
-+ Added "response_mode" to the non normative example. This demonstrates the use of Authorization Code Flow in conjunction with JARM and FAPI 1.0
-```
-
```
#Decoded Request Object JWT
@@ -75,10 +71,6 @@
}
```
-```diff
-Replaced FAPI draft references with FAPI 1.0 Final references
-```
-
The Request Object is a signed and encoded JWT specified in [section 6.1](https://openid.net/specs/openid-connect-core-1_0.html#RequestObject) of **[OIDC]**. As per **[[FAPI-1.0-Advanced]](#nref-FAPI-1-0-Advanced)** [section 5.2.2](https://openid.net/specs/openid-financial-api-part-2-1_0.html#authorization-server), the `request` parameter **MUST** be present on requests to the **[OIDC]** Hybrid Authorisation End Point. The Request Object enables **[OIDC]** requests to be passed in a single and self-contained parameter.
Request Objects **MUST** be signed by Data Recipient Software Products as specified in [section 8.6](https://openid.net/specs/openid-financial-api-part-2-1_0.html#algorithm-considerations) of **[[FAPI-1.0-Advanced]](#nref-FAPI-1-0-Advanced)**.
@@ -124,10 +116,6 @@ In addition:
Data Holders **MUST** support Pushed Authorisation Requests (PAR) via the pushed authorisation end point according to **[[PAR]](#nref-PAR)**.
-```diff
-Removed legacy phasing requirements for FAPI 1.0 Final
-```
-
* Data Holders **MUST** support **[[RFC9126]](#nref-RFC9126)** (PAR) using **[[PKCE]](#nref-PKCE)** (**[[RFC7636]](#nref-RFC7636)**) with S256 as the code challenge method in accordance with **[[FAPI-1.0-Advanced]](#nref-FAPI-1-0-Advanced)** [section 5.2.2](https://openid.net/specs/openid-financial-api-part-2-1_0.html#authorization-server).
* Data Holders **MUST** require PAR for authorisation request data in accordance with **[[RFC9126]](#nref-RFC9126)** where "require_pushed_authorization_requests" parameter is set to "true".
* Data Holders **MUST** require the request object to contain an "exp" claim that has a lifetime of no longer than 60 minutes after the "nbf" claim in accordance with **[[FAPI-1.0-Advanced]](#nref-FAPI-1-0-Advanced)** [section 5.2.2](https://openid.net/specs/openid-financial-api-part-2-1_0.html#authorization-server).
@@ -137,10 +125,6 @@ Removed legacy phasing requirements for FAPI 1.0 Final
#### Data Recipient Software Products
-```diff
-Removed legacy phasing requirements for FAPI 1.0 Final
-```
-
* Data Recipients Software Products **MUST** send request object containing a "nbf" claim and an "exp" claim that has a lifetime of no longer than 60 minutes after the "nbf" claim.
* Data Recipient Software Products **MUST** ONLY use a "request_uri" value once
* Data Recipients **MUST** ONLY send authorisation request data using **[[RFC9126]](#nref-RFC9126)** (PAR) and use **[[PKCE]](#nref-PKCE)** (**[[RFC7636]](#nref-RFC7636)**) in accordance with **[[FAPI-1.0-Advanced]](#nref-FAPI-1-0-Advanced)**.
diff --git a/slate/source/includes/security/_tokens.md b/slate/source/includes/security/_tokens.md
index 38a99568..d1d2e520 100644
--- a/slate/source/includes/security/_tokens.md
+++ b/slate/source/includes/security/_tokens.md
@@ -39,10 +39,6 @@ ID Tokens are specified in [section 2](https://openid.net/specs/openid-connect-c
#### Baseline ID Token requirements
-```diff
-Replaced FAPI draft references with FAPI 1.0 Final references
-```
-
In addition to the mandatory claims specified in [section 2](https://openid.net/specs/openid-connect-core-1_0.html#IDToken) of the **[[OIDC]](#nref-OIDC)** standard, required claims for ID Tokens as part of Hybrid Flow authentication **MUST** align to [section 3.3](https://openid.net/specs/openid-connect-core-1_0.html#HybridFlowAuth) (Authentication using the Hybrid Flow) of the **[[OIDC]](#nref-OIDC)** standards and [section 5.2.2](https://openid.net/specs/openid-financial-api-part-2-1_0.html#authorization-server) and [section 8.4.3](https://openid.net/specs/openid-financial-api-part-2-1_0.html#authorization-response-parameter-injection-attack) of the **[[FAPI-1.0-Advanced]](#nref-FAPI-1-0-Advanced)** profile.
ID Tokens **MUST** be signed by Data Holders as specified in [section 8.6](https://openid.net/specs/openid-financial-api-part-2-1_0.html#algorithm-considerations) of **[[FAPI-1.0-Advanced]](#nref-FAPI-1-0-Advanced)**.
@@ -50,19 +46,12 @@ ID Tokens **MUST** be signed by Data Holders as specified in [section 8.6](https
#### OIDC Hybrid Flow requirements
-```diff
-Replaced FAPI draft references with FAPI 1.0 Final references
-```
-
In accordance with **[[FAPI-1.0-Advanced]](#nref-FAPI-1-0-Advanced)**, ID Tokens **MUST** be signed and encrypted when returned to a Data Recipient Software Product from both the Authorisation End Point and Token End Point.
The ID Token returned from the Authorisation End Point **MUST NOT** contain any Personal Information (PI) claims.
##### Hashing value for state and authorisation code
-```diff
-Replaced FAPI draft references with FAPI 1.0 Final references
-```
The following requirements apply to the OIDC Hybrid Flow:
* The `c_hash` value **MUST** be generated according to [section 3.3.2.11](https://openid.net/specs/openid-connect-core-1_0.html#HybridIDToken) of **[[OIDC]](#nref-OIDC)**.
@@ -80,10 +69,6 @@ An Access Token **MUST** expire between **2 minutes** to **10 minutes** after th
The process for refreshing an Access Token is described in [section 12.1](https://openid.net/specs/openid-connect-core-1_0.html#RefreshingAccessToken) of **[[OIDC]](#nref-OIDC)**.
-```diff
-Removed legacy phasing requirements for FAPI 1.0 Final
-```
-
* Data Holders **MUST** reject token request with an authorization code (Section 1.3.1 of **[[RFC6749]](#nref-RFC6749)**) if it has been previously used
@@ -96,10 +81,6 @@ The expiration time for a Refresh Token **MUST** be set by the Data Holder.
Refresh Token expiration **MAY** be any length of time greater than 28 days but **MUST NOT** exceed the end of the duration of sharing consented to by the Consumer.
-```diff
-Removed legacy phasing requirements for FAPI 1.0 Final
-```
-
* Data Holders **MUST NOT** cycle refresh tokens (rotation). In other words, Refresh Tokens **SHOULD** be issued with an "exp" equal to the sharing duration authorised by the Customer.
### Token Expiry
@@ -107,9 +88,4 @@ The expiry time for issued access tokens and refresh tokens **MUST** be determin
In order to achieve this:
-```diff
-Removed legacy phasing requirements for FAPI 1.0 Final
-```
-
- The Data Holder **MUST** indicate the lifetime in seconds of the access token in the `expires_in` field of the JSON object returned by the token end-point (see [section 4.2.2] (https://tools.ietf.org/html/rfc6749#section-4.2.2) of **[[OAUTH2]](#nref-OAUTH2)**).
-
diff --git a/slate/source/includes/security/_transport_security.md b/slate/source/includes/security/_transport_security.md
index ef308bc5..b69ef042 100644
--- a/slate/source/includes/security/_transport_security.md
+++ b/slate/source/includes/security/_transport_security.md
@@ -24,9 +24,7 @@ OAUTB SHALL NOT be supported due to a lack industry support.
**[[MTLS]](#nref-MTLS)** HoK allows issued tokens to be bound to a client certificate as specified in [section 3](https://tools.ietf.org/id/draft-ietf-oauth-mtls-07.html#SenderConstrainedAccess) of **[[MTLS]](#nref-MTLS)**.
### Ciphers
-```diff
-Replaced FAPI draft RW references with FAPI 1.0 Final Advanced references. References pertain to the TLS considerations.
-```
+
Only the following cipher suites SHALL be permitted in accordance with [section 8.5](https://openid.net/specs/openid-financial-api-part-2-1_0.html#tls-considerations) of **[[FAPI-1.0-Advanced]](#nref-FAPI-1-0-Advanced)**:
- TLS\_DHE\_RSA\_WITH\_AES\_128\_GCM\_SHA256
diff --git a/slate/source/includes/security/endpoints/_authorisation.md b/slate/source/includes/security/endpoints/_authorisation.md
index 50c0706d..a5136149 100644
--- a/slate/source/includes/security/endpoints/_authorisation.md
+++ b/slate/source/includes/security/endpoints/_authorisation.md
@@ -55,7 +55,7 @@ Host: www.holder.com.au
> Non-Normative Example - FAPI 1.0 Final Phase 3 Obligation
> This example demonstrates how an ADR may send a staged authorisation request (using PAR) in the back-channel to the Data Holder.
->
+>
> It demonstrates a FAPI 1.0 Final compliant authorisation request using the PAR to first submit the authorisation request object.
```
@@ -76,10 +76,6 @@ Host: www.holder.com.au
| Client Authentication Required| No|
| Bearer Token Required| No|
-```diff
-Replaced FAPI draft references with FAPI 1.0 Final references
-```
-
The requirements for the Authorisation End Point are specified in [section 3.3.2](https://openid.net/specs/openid-connect-core-1_0.html#HybridAuthorizationEndpoint) of **[[OIDC]](#nref-OIDC)** and further specified under section [5.2.2](https://openid.net/specs/openid-financial-api-part-2-1_0.html#authorization-server) of **[[FAPI-1.0-Advanced]](#nref-FAPI-1-0-Advanced)**. This end point is invoked as part of the [Hybrid Authentication flow](#hybrid-flow).
This endpoint does not require [CORS](https://consumerdatastandardsaustralia.github.io/standards/#cors).
diff --git a/slate/source/includes/security/endpoints/_oidc_provider_configuration.md b/slate/source/includes/security/endpoints/_oidc_provider_configuration.md
index 525522e7..00328234 100644
--- a/slate/source/includes/security/endpoints/_oidc_provider_configuration.md
+++ b/slate/source/includes/security/endpoints/_oidc_provider_configuration.md
@@ -2,10 +2,6 @@
> Non-Normative Example
-```diff
-+ Adds examples for all metadata parameters required by the Data Standards and upstream normative references
-```
-
```
## Request
@@ -36,18 +32,18 @@ Content-Type: application/json
"token_endpoint_auth_methods_supported": ["private_key_jwt"],
"token_endpoint_auth_signing_alg_values_supported": ["ES256", "PS256"],
"userinfo_endpoint": "https://www.dh.com.au/userinfo",
-
+
"code_challenge_methods_supported": "S256",
"introspection_endpoint": "https://www.dh.com.au/introspect",
"revocation_endpoint": "https://www.dh.com.au/revoke",
-
+
"tls_client_certificate_bound_access_tokens": true,
"pushed_authorization_request_endpoint": "https://data.holder.com.au/par",
"require_pushed_authorization_requests": true,
-
+
"authorization_encryption_alg_values_supported": ["RSA-OAEP", "RSA-OAEP-256"],
-
+
"authorization_encryption_enc_values_supported": ["A256GCM", "A128CBC-HS256"],
"authorization_signing_alg_values_supported": ["ES256", "PS256"],
@@ -66,11 +62,6 @@ Data Holders MUST make their OpenID Provider Metadata available via a configurat
This endpoint does not require [CORS](https://consumerdatastandardsaustralia.github.io/standards/#cors).
-```diff
-Replaced FAPI draft references with FAPI 1.0 Final references
-
-+ Adds all metadata parameters required by the Data Standards and upstream normative references
-```
At a minimum, the Data Holder metadata **MUST** include:
**[[OIDD]](#nref-OIDD)**
@@ -81,11 +72,11 @@ At a minimum, the Data Holder metadata **MUST** include:
- `grant_types_supported`: The list of the OAuth 2.0 Grant Type values supported
- `id_token_encryption_alg_values_supported`: The list of the supported JWE algorithms for securing the issued ID tokens. Must conform to **[[FAPI-RW-Draft]](#nref-FAPI-RW-Draft)** and **[[OIDD]](#nref-OIDD)**. Required for Data Holders supporting OIDC Hybrid Flow
- `id_token_encryption_enc_values_supported`: The list of the supported JWE encryption methods for securing the issued ID tokens. Required for Data Holders supporting OIDC Hybrid Flow
-- `id_token_signing_alg_values_supported`: The list of the JWS signing algorithms (`alg` values) supported
+- `id_token_signing_alg_values_supported`: The list of the JWS signing algorithms (`alg` values) supported
- `issuer`: URL that the Data Holder asserts as its Issuer Identifier
- `jwks_uri`: The JSON Web Key Set for the data holder
- `registration_endpoint`: URL of the Client Registration End Point
-- `request_object_signing_alg_values_supported`: The list of the JWS signing algorithms (`alg` values) supported for signing request objects.
+- `request_object_signing_alg_values_supported`: The list of the JWS signing algorithms (`alg` values) supported for signing request objects.
- `response_modes_supported`: The list of the OAuth 2.0 `response_mode` values supported
- `response_types_supported`: The list of the OAuth 2.0 `response_type` values supported
- `scopes_supported`: The list of supported scopes
@@ -122,4 +113,3 @@ Where Data Holders support authorisation response encryption according to **[[JA
In addition, the Data Holder metadata **MUST** also include:
- `cdr_arrangement_revocation_endpoint`: The URL of the CDR Arrangement Revocation End Point for consent revocation
-
diff --git a/slate/source/includes/security/endpoints/_par.md b/slate/source/includes/security/endpoints/_par.md
index bd1ff1dd..a0419401 100644
--- a/slate/source/includes/security/endpoints/_par.md
+++ b/slate/source/includes/security/endpoints/_par.md
@@ -1,10 +1,6 @@
### Pushed Authorisation End Point
-```diff
-Updated non-normtative example to use RFC9126, not the draft PAR specification
-```
-
> Non-Normative Example
> Utilising RFC9126 and OIDC Hybrid Flow
@@ -94,10 +90,6 @@ request=eyJhbGciOiJQUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6IjEyMyJ9.ey...
> Decoded Request - FAPI 1.0 Final Phase 3 Obligation
This example shows an authorisation request using the Authorisation Code Flow (FAPI 1.0 migration Phase 3)
-```diff
-+ Added "response_mode" to the non normative example. This demonstrates the use of Authorization Code Flow in conjunction with JARM and FAPI 1.0
-```
-
```
{
"iss": "s6BhdRkqt3",
@@ -183,10 +175,6 @@ eyJraWQiOiIwZWQ3YTNkZi1hMGJlLTRhZjQtOTk0YS1jNDBhODc0ODQwNjMiLCJhbGciOiJQUzI1NiJ9
Data Holders **MUST** support Pushed Authorisation Requests (PAR) via the pushed authorisation end point according to **[[PAR]](#nref-PAR)**.
-```diff
-- Removed legacy phasing requirements for FAPI 1.0 Final using PAR
-```
-
Data Recipient Software Products **MUST** send authorisation requests using **[[PAR]](#nref-PAR)** if supported by the Data Holder.
The Data Holder response provides the Data Recipient Software Product with a Request URI in the response. The Request URI is then passed to the Data Holder’s Authorisation End Point to initiate an authorisation flow.
diff --git a/slate/source/includes/standards/_headers.md b/slate/source/includes/standards/_headers.md
index 20bfe38f..65e0dde3 100644
--- a/slate/source/includes/standards/_headers.md
+++ b/slate/source/includes/standards/_headers.md
@@ -28,11 +28,6 @@ Supported HTTP headers, and their usage, for the standards are as laid out in th
`Accept-Encoding: charset=UTF-8`
`Accept: AppliCAtion/JSon;Charset=uTf-8`
-```diff
-Replaced FAPI draft references with FAPI 1.0 Final references.
-References pertain to the x-fapi-auth-date header.
-```
-
Header Field | Description | Mandatory?
-------------|-------------|-----------
**Content-Type** | Standard HTTP Header. Represents the format of the payload provided in the request. The media type must be set to `application/json`. Mandatory for PUT and POST calls.| Conditional
diff --git a/slate/source/includes/swagger/cds_admin.json b/slate/source/includes/swagger/cds_admin.json
index 39dee4f9..d3b4f529 100644
--- a/slate/source/includes/swagger/cds_admin.json
+++ b/slate/source/includes/swagger/cds_admin.json
@@ -12,7 +12,7 @@
"url" : "https://opensource.org/licenses/MIT"
},
"title" : "CDR Admin API",
- "version" : "1.25.0"
+ "version" : "1.26.0"
},
"servers" : [ {
"url" : "https://data.holder.com.au/cds-au/v1"
@@ -103,7 +103,7 @@
},
"/admin/metrics" : {
"get" : {
- "description" : "This end point allows the ACCC to obtain operational statistics from the Data Holder (at the Data Holder Brand level) on the operation of their CDR compliant implementation. The statistics obtainable from this end point are determined by the non-functional requirements for the CDR regime.\n\nThis end point is not required to be implemented by the Australian Energy Market Operator, the Australian Energy Regulator or the Department of State administered by the Minister of Victoria administering the National Electricity (Victoria) Act 2005 (Vic).\n\nNOTE: This version must be implemented by **June 13th 2024**\n\nObsolete versions: [v1](includes/obsolete/get-metrics-v1.html) [v2](includes/obsolete/get-metrics-v2.html).\n\nDeprecated versions:\n\n- [v3](includes/obsolete/get-metrics-v3.html)\n- [v4](includes/obsolete/get-metrics-v4.html) - This version, or v5, must be implemented by **November 1st 2023**\n\nIf the Data Holder supports private_key_jwt client authentication they MUST validate the scope.",
+ "description" : "This end point allows the ACCC to obtain operational statistics from the Data Holder (at the Data Holder Brand level) on the operation of their CDR compliant implementation. The statistics obtainable from this end point are determined by the non-functional requirements for the CDR regime.\n\nThis end point is not required to be implemented by the Australian Energy Market Operator, the Australian Energy Regulator or the Department of State administered by the Minister of Victoria administering the National Electricity (Victoria) Act 2005 (Vic).\n\nNOTE: This version **MUST** be implemented by **May 13th 2024**\n\nObsolete versions: [v1](includes/obsolete/get-metrics-v1.html) [v2](includes/obsolete/get-metrics-v2.html).\n\nDeprecated versions:\n\n- [v3](includes/obsolete/get-metrics-v3.html) - Implementation not required for Data Holders going live on, or after, 1st November 2023. Other Data Holders **MAY** retire this version from the earlier of **13th May 2023** or from the time ACCC announce that they no longer call this version\n- [v4](includes/obsolete/get-metrics-v4.html) - This version, or v5, **MUST** be implemented by **November 1st 2023**\n\nIf the Data Holder supports private_key_jwt client authentication they MUST validate the scope.",
"operationId" : "getMetrics",
"parameters" : [ {
"description" : "The period of metrics to be requested. Values can be CURRENT (meaning metrics for current period, dependent on the metric type), HISTORIC (meaning metrics for previous period, depending on the metric type) or ALL. If absent the default is ALL.",
diff --git a/slate/source/includes/swagger/cds_admin.yaml b/slate/source/includes/swagger/cds_admin.yaml
index 4224a198..4d9c5e2b 100644
--- a/slate/source/includes/swagger/cds_admin.yaml
+++ b/slate/source/includes/swagger/cds_admin.yaml
@@ -11,7 +11,7 @@ info:
name: MIT License
url: https://opensource.org/licenses/MIT
title: CDR Admin API
- version: 1.25.0
+ version: 1.26.0
servers:
- url: https://data.holder.com.au/cds-au/v1
paths:
@@ -99,14 +99,14 @@ paths:
This end point is not required to be implemented by the Australian Energy Market Operator, the Australian Energy Regulator or the Department of State administered by the Minister of Victoria administering the National Electricity (Victoria) Act 2005 (Vic).
- NOTE: This version must be implemented by **June 13th 2024**
+ NOTE: This version **MUST** be implemented by **May 13th 2024**
Obsolete versions: [v1](includes/obsolete/get-metrics-v1.html) [v2](includes/obsolete/get-metrics-v2.html).
Deprecated versions:
- - [v3](includes/obsolete/get-metrics-v3.html)
- - [v4](includes/obsolete/get-metrics-v4.html) - This version, or v5, must be implemented by **November 1st 2023**
+ - [v3](includes/obsolete/get-metrics-v3.html) - Implementation not required for Data Holders going live on, or after, 1st November 2023. Other Data Holders **MAY** retire this version from the earlier of **13th May 2023** or from the time ACCC announce that they no longer call this version
+ - [v4](includes/obsolete/get-metrics-v4.html) - This version, or v5, **MUST** be implemented by **November 1st 2023**
If the Data Holder supports private_key_jwt client authentication they MUST validate the scope.
operationId: getMetrics
diff --git a/slate/source/includes/swagger/cds_banking.json b/slate/source/includes/swagger/cds_banking.json
index 34a6ea49..2e1b188a 100644
--- a/slate/source/includes/swagger/cds_banking.json
+++ b/slate/source/includes/swagger/cds_banking.json
@@ -12,7 +12,7 @@
"url" : "https://opensource.org/licenses/MIT"
},
"title" : "CDR Banking API",
- "version" : "1.25.0"
+ "version" : "1.26.0"
},
"servers" : [ {
"url" : "https://data.holder.com.au/cds-au/v1"
diff --git a/slate/source/includes/swagger/cds_banking.yaml b/slate/source/includes/swagger/cds_banking.yaml
index 4aa84cfd..71c6c308 100644
--- a/slate/source/includes/swagger/cds_banking.yaml
+++ b/slate/source/includes/swagger/cds_banking.yaml
@@ -11,7 +11,7 @@ info:
name: MIT License
url: https://opensource.org/licenses/MIT
title: CDR Banking API
- version: 1.25.0
+ version: 1.26.0
servers:
- url: https://data.holder.com.au/cds-au/v1
paths:
diff --git a/slate/source/includes/swagger/cds_common.json b/slate/source/includes/swagger/cds_common.json
index 21b25e4d..a008df9e 100644
--- a/slate/source/includes/swagger/cds_common.json
+++ b/slate/source/includes/swagger/cds_common.json
@@ -12,7 +12,7 @@
"url" : "https://opensource.org/licenses/MIT"
},
"title" : "CDR Common API",
- "version" : "1.25.0"
+ "version" : "1.26.0"
},
"servers" : [ {
"url" : "https://data.holder.com.au/cds-au/v1"
diff --git a/slate/source/includes/swagger/cds_common.yaml b/slate/source/includes/swagger/cds_common.yaml
index 1191a04d..11e75e9c 100644
--- a/slate/source/includes/swagger/cds_common.yaml
+++ b/slate/source/includes/swagger/cds_common.yaml
@@ -11,7 +11,7 @@ info:
name: MIT License
url: https://opensource.org/licenses/MIT
title: CDR Common API
- version: 1.25.0
+ version: 1.26.0
servers:
- url: https://data.holder.com.au/cds-au/v1
paths:
diff --git a/slate/source/includes/swagger/cds_dcr.json b/slate/source/includes/swagger/cds_dcr.json
index ba6399e7..f157e1b4 100644
--- a/slate/source/includes/swagger/cds_dcr.json
+++ b/slate/source/includes/swagger/cds_dcr.json
@@ -3,7 +3,7 @@
"info" : {
"description" : "This specification defines the APIs for Data Holders exposing Dynamic Client Registration endpoints.",
"title" : "CDR Dynamic Client Registration API",
- "version" : "1.25.0"
+ "version" : "1.26.0"
},
"servers" : [ {
"url" : "https://data.holder.com.au/"
diff --git a/slate/source/includes/swagger/cds_dcr.yaml b/slate/source/includes/swagger/cds_dcr.yaml
index 015a04fc..b64bb755 100644
--- a/slate/source/includes/swagger/cds_dcr.yaml
+++ b/slate/source/includes/swagger/cds_dcr.yaml
@@ -3,7 +3,7 @@ info:
description: This specification defines the APIs for Data Holders exposing Dynamic
Client Registration endpoints.
title: CDR Dynamic Client Registration API
- version: 1.25.0
+ version: 1.26.0
servers:
- url: https://data.holder.com.au/
paths:
diff --git a/slate/source/includes/swagger/cds_energy.json b/slate/source/includes/swagger/cds_energy.json
index 8ea5cf26..27cb88cc 100644
--- a/slate/source/includes/swagger/cds_energy.json
+++ b/slate/source/includes/swagger/cds_energy.json
@@ -3,7 +3,7 @@
"info" : {
"description" : "Consumer Data Right end points and payloads for the Energy sector",
"title" : "CDR Energy API",
- "version" : "1.25.0"
+ "version" : "1.26.0"
},
"servers" : [ {
"url" : "/"
diff --git a/slate/source/includes/swagger/cds_energy.yaml b/slate/source/includes/swagger/cds_energy.yaml
index e3a34b42..231ae892 100644
--- a/slate/source/includes/swagger/cds_energy.yaml
+++ b/slate/source/includes/swagger/cds_energy.yaml
@@ -2,7 +2,7 @@ openapi: 3.0.3
info:
description: Consumer Data Right end points and payloads for the Energy sector
title: CDR Energy API
- version: 1.25.0
+ version: 1.26.0
servers:
- url: /
paths:
diff --git a/slate/source/includes/swagger/cds_energy_sdh.json b/slate/source/includes/swagger/cds_energy_sdh.json
index bea5cd11..83df0445 100644
--- a/slate/source/includes/swagger/cds_energy_sdh.json
+++ b/slate/source/includes/swagger/cds_energy_sdh.json
@@ -3,7 +3,7 @@
"info" : {
"description" : "Consumer Data Right end points and payloads for Secondary Data Holder for the Energy sector",
"title" : "CDR Energy Secondary Data Holder API",
- "version" : "1.25.0"
+ "version" : "1.26.0"
},
"servers" : [ {
"url" : "/"
diff --git a/slate/source/includes/swagger/cds_energy_sdh.yaml b/slate/source/includes/swagger/cds_energy_sdh.yaml
index 205dace7..e917ee2c 100644
--- a/slate/source/includes/swagger/cds_energy_sdh.yaml
+++ b/slate/source/includes/swagger/cds_energy_sdh.yaml
@@ -3,7 +3,7 @@ info:
description: Consumer Data Right end points and payloads for Secondary Data Holder
for the Energy sector
title: CDR Energy Secondary Data Holder API
- version: 1.25.0
+ version: 1.26.0
servers:
- url: /
paths:
diff --git a/slate/source/includes/swagger/cds_register.json b/slate/source/includes/swagger/cds_register.json
index 77f75c20..67b17f36 100644
--- a/slate/source/includes/swagger/cds_register.json
+++ b/slate/source/includes/swagger/cds_register.json
@@ -2,7 +2,7 @@
"openapi" : "3.0.3",
"info" : {
"title" : "CDR Participant Discovery API",
- "version" : "1.25.0"
+ "version" : "1.26.0"
},
"servers" : [ {
"url" : "https:///"
diff --git a/slate/source/includes/swagger/cds_register.yaml b/slate/source/includes/swagger/cds_register.yaml
index 59cef5e5..2b68399c 100644
--- a/slate/source/includes/swagger/cds_register.yaml
+++ b/slate/source/includes/swagger/cds_register.yaml
@@ -1,7 +1,7 @@
openapi: 3.0.3
info:
title: CDR Participant Discovery API
- version: 1.25.0
+ version: 1.26.0
servers:
- url: https:///
paths:
diff --git a/slate/source/includes/swagger/cds_telco.json b/slate/source/includes/swagger/cds_telco.json
index d2833d51..75e68814 100644
--- a/slate/source/includes/swagger/cds_telco.json
+++ b/slate/source/includes/swagger/cds_telco.json
@@ -12,7 +12,7 @@
"url" : "https://opensource.org/licenses/MIT"
},
"title" : "CDR Telco API",
- "version" : "1.25.0"
+ "version" : "1.26.0"
},
"servers" : [ {
"url" : "https://data.holder.com.au/cds-au/v1"
diff --git a/slate/source/includes/swagger/cds_telco.yaml b/slate/source/includes/swagger/cds_telco.yaml
index eadaadf8..fe6475bd 100644
--- a/slate/source/includes/swagger/cds_telco.yaml
+++ b/slate/source/includes/swagger/cds_telco.yaml
@@ -11,7 +11,7 @@ info:
name: MIT License
url: https://opensource.org/licenses/MIT
title: CDR Telco API
- version: 1.25.0
+ version: 1.26.0
servers:
- url: https://data.holder.com.au/cds-au/v1
paths:
diff --git a/swagger-gen/api/cds_admin.json b/swagger-gen/api/cds_admin.json
index 9d1b8e04..1d9caf7f 100644
--- a/swagger-gen/api/cds_admin.json
+++ b/swagger-gen/api/cds_admin.json
@@ -12,7 +12,7 @@
"name": "MIT License",
"url": "https://opensource.org/licenses/MIT"
},
- "version": "1.25.0"
+ "version": "1.26.0"
},
"servers": [
{
@@ -111,7 +111,7 @@
"Metrics"
],
"summary": "Get Metrics",
- "description": "This end point allows the ACCC to obtain operational statistics from the Data Holder (at the Data Holder Brand level) on the operation of their CDR compliant implementation. The statistics obtainable from this end point are determined by the non-functional requirements for the CDR regime.\n\nThis end point is not required to be implemented by the Australian Energy Market Operator, the Australian Energy Regulator or the Department of State administered by the Minister of Victoria administering the National Electricity (Victoria) Act 2005 (Vic).\n\nNOTE: This version must be implemented by **June 13th 2024**\n\nObsolete versions: [v1](includes/obsolete/get-metrics-v1.html) [v2](includes/obsolete/get-metrics-v2.html).\n\nDeprecated versions:\n\n- [v3](includes/obsolete/get-metrics-v3.html)\n- [v4](includes/obsolete/get-metrics-v4.html) - This version, or v5, must be implemented by **November 1st 2023**\n\nIf the Data Holder supports private_key_jwt client authentication they MUST validate the scope.",
+ "description": "This end point allows the ACCC to obtain operational statistics from the Data Holder (at the Data Holder Brand level) on the operation of their CDR compliant implementation. The statistics obtainable from this end point are determined by the non-functional requirements for the CDR regime.\n\nThis end point is not required to be implemented by the Australian Energy Market Operator, the Australian Energy Regulator or the Department of State administered by the Minister of Victoria administering the National Electricity (Victoria) Act 2005 (Vic).\n\nNOTE: This version **MUST** be implemented by **May 13th 2024**\n\nObsolete versions: [v1](includes/obsolete/get-metrics-v1.html) [v2](includes/obsolete/get-metrics-v2.html).\n\nDeprecated versions:\n\n- [v3](includes/obsolete/get-metrics-v3.html) - Implementation not required for Data Holders going live on, or after, 1st November 2023. Other Data Holders **MAY** retire this version from the earlier of **13th May 2023** or from the time ACCC announce that they no longer call this version\n- [v4](includes/obsolete/get-metrics-v4.html) - This version, or v5, **MUST** be implemented by **November 1st 2023**\n\nIf the Data Holder supports private_key_jwt client authentication they MUST validate the scope.",
"operationId": "getMetrics",
"parameters": [
{
diff --git a/swagger-gen/api/cds_banking.json b/swagger-gen/api/cds_banking.json
index 0c16d47f..a05c888a 100644
--- a/swagger-gen/api/cds_banking.json
+++ b/swagger-gen/api/cds_banking.json
@@ -12,7 +12,7 @@
"name": "MIT License",
"url": "https://opensource.org/licenses/MIT"
},
- "version": "1.25.0"
+ "version": "1.26.0"
},
"servers": [
{
@@ -5465,7 +5465,7 @@
"enum": [
"accountId",
"biller",
- "digitalWallet",
+ "digitalWallet",
"domestic",
"international",
"payeeId"
@@ -5491,7 +5491,7 @@
},
"digitalWallet": {
"$ref": "#/components/schemas/BankingDigitalWalletPayee"
- },
+ },
"domestic": {
"$ref": "#/components/schemas/BankingDomesticPayee"
},
diff --git a/swagger-gen/api/cds_common.json b/swagger-gen/api/cds_common.json
index 916d5d0d..167e5fbf 100644
--- a/swagger-gen/api/cds_common.json
+++ b/swagger-gen/api/cds_common.json
@@ -12,7 +12,7 @@
"name": "MIT License",
"url": "https://opensource.org/licenses/MIT"
},
- "version": "1.25.0"
+ "version": "1.26.0"
},
"servers": [
{
diff --git a/swagger-gen/api/cds_dcr.json b/swagger-gen/api/cds_dcr.json
index 53798a78..0ef35d9d 100644
--- a/swagger-gen/api/cds_dcr.json
+++ b/swagger-gen/api/cds_dcr.json
@@ -3,7 +3,7 @@
"info": {
"title": "CDR Dynamic Client Registration API",
"description": "This specification defines the APIs for Data Holders exposing Dynamic Client Registration endpoints.",
- "version": "1.25.0"
+ "version": "1.26.0"
},
"servers": [
{
diff --git a/swagger-gen/api/cds_energy.json b/swagger-gen/api/cds_energy.json
index 2a90f1a4..80b3c4bd 100644
--- a/swagger-gen/api/cds_energy.json
+++ b/swagger-gen/api/cds_energy.json
@@ -3,7 +3,7 @@
"info": {
"title": "CDR Energy API",
"description": "Consumer Data Right end points and payloads for the Energy sector",
- "version": "1.25.0"
+ "version": "1.26.0"
},
"components": {
"schemas": {
diff --git a/swagger-gen/api/cds_energy_sdh.json b/swagger-gen/api/cds_energy_sdh.json
index 4ed8d885..bf07ccc5 100644
--- a/swagger-gen/api/cds_energy_sdh.json
+++ b/swagger-gen/api/cds_energy_sdh.json
@@ -3,7 +3,7 @@
"info": {
"title": "CDR Energy Secondary Data Holder API",
"description": "Consumer Data Right end points and payloads for Secondary Data Holder for the Energy sector",
- "version": "1.25.0"
+ "version": "1.26.0"
},
"components": {
"schemas": {
diff --git a/swagger-gen/api/cds_register.json b/swagger-gen/api/cds_register.json
index 0effbcf7..1998e7b3 100644
--- a/swagger-gen/api/cds_register.json
+++ b/swagger-gen/api/cds_register.json
@@ -2,7 +2,7 @@
"openapi": "3.0.3",
"info": {
"title": "CDR Participant Discovery API",
- "version": "1.25.0"
+ "version": "1.26.0"
},
"servers": [
{
diff --git a/swagger-gen/api/cds_telco.json b/swagger-gen/api/cds_telco.json
index 2372882d..a5af6cc5 100644
--- a/swagger-gen/api/cds_telco.json
+++ b/swagger-gen/api/cds_telco.json
@@ -12,7 +12,7 @@
"url": "https://opensource.org/licenses/MIT"
},
"title": "CDR Telco API",
- "version": "1.25.0"
+ "version": "1.26.0"
},
"servers": [ {
"url": "https://data.holder.com.au/cds-au/v1"
diff --git a/swagger-gen/cds_admin.md b/swagger-gen/cds_admin.md
index eea960a2..adf6ae4a 100644
--- a/swagger-gen/cds_admin.md
+++ b/swagger-gen/cds_admin.md
@@ -145,14 +145,14 @@ This end point allows the ACCC to obtain operational statistics from the Data Ho
This end point is not required to be implemented by the Australian Energy Market Operator, the Australian Energy Regulator or the Department of State administered by the Minister of Victoria administering the National Electricity (Victoria) Act 2005 (Vic).
-NOTE: This version must be implemented by **June 13th 2024**
+NOTE: This version **MUST** be implemented by **May 13th 2024**
Obsolete versions: [v1](includes/obsolete/get-metrics-v1.html) [v2](includes/obsolete/get-metrics-v2.html).
Deprecated versions:
-- [v3](includes/obsolete/get-metrics-v3.html)
-- [v4](includes/obsolete/get-metrics-v4.html) - This version, or v5, must be implemented by **November 1st 2023**
+- [v3](includes/obsolete/get-metrics-v3.html) - Implementation not required for Data Holders going live on, or after, 1st November 2023. Other Data Holders **MAY** retire this version from the earlier of **13th May 2023** or from the time ACCC announce that they no longer call this version
+- [v4](includes/obsolete/get-metrics-v4.html) - This version, or v5, **MUST** be implemented by **November 1st 2023**
If the Data Holder supports private_key_jwt client authentication they MUST validate the scope.