DSB Maintenance Iteration 9: Agenda & Meeting Notes (17 November 2021)

DSB Maintenance Iteration 9 - Agenda & Meeting Notes (2021-11-17)

Date and time: 17/11/2021, 2pm - 4pm AEDT (1pm - 3pm AEST)
Location: WebEx
Dial-in details:

https://treasuryau.webex.com/treasuryau/j.php?MTID=m6786d3cadd2da38bd3ae2bf7cca07212
Dial In Number: +61 2 9338 2221
Dial In Access Code: 265 1917 2241
Quick Dial: +61-2-9338-2221,,26519172241##

Chair: Mark Verstege Maintenance overview: Further information
Maintenance project board: See here
Decision Proposal: This maintenance iteration is being consulted on under Decision Proposal 212

Agenda

Wait 5 minutes for all participants to join. Kickoff at 2:05pm (AEDT)
Outstanding Actions
Release plan: schedule of forwards looking standards releases
Open Decision Proposals: key consultation dates
Iteration 9 change request candidates
Any other business

Meeting notes

Meeting Notes
Next steps

Introductions

This week is the sixth call of the 9th maintenance iteration. The purpose of the meeting is to discuss options for iteration candidates adopted in the 9th maintenance iteration. This meeting has been extended to two hours.

Please note: This maintenance iteration has been extended by 4 weeks and will conclude 1st December 2021. This is to incorporate energy change requests and align to end of year shutdown.

Allow 5 min for participants to join
Housekeeping
Overview, purpose and intended outcomes of the meeting

Actions

ANZ to create a change request to better support cursors for returning large result sets.
(IDToken) DSB to create a CR for customer definition
(IDToken) [IN PROGRESS] DSB to seek clarification regarding rules for nominated representatives
(Issue #401) DSB to identify if a change request already exists to deal with introductory offers. If not, the community will raise one.
(Issue #292) DSB to propose strawman solution
(Issue #291) DSB to propose strawman solution

Release plan

v1.12.0 was published on 14th of October 2021: This release contains binding non-functional requirements for banking and energy
v1.13.0 was published published on the 22nd of October 2021: porting of Register standards from ACCC
v1.14.0 was published on the 29th of October 2021: Energy API standards
v1.15.0+: no current release candidates are scheduled

Open / Active Decision Proposals

The following decision proposals are open for community feedback

DP #	Closing date	DP
216	19/02/2022	Decision Proposal 216 - Profile Scope Support
209	19/11/2021	Decision Proposal 209 - Transition to FAPI 1.0 Advanced Profile
162	30/11/2021	Decision Proposal 162 - CX Standards \| Joint Accounts
222	30/11/2021	Decision Proposal 222 - CX Standards \| Insights and Trusted Adviser Disclosure Consents
225	18/02/2022	Decision Proposal 225 - Data Recipient Security Standards
211	Pending	Decision Proposal 211 - Scope of Risk-based Authentication and Identity Proofing Framework, Threat and Attack Model
210	Pending	Decision Proposal 210 - Transition to FAPI 2.0 Profile
203	No closing date	Normative Standards Review (2021)
158	Closed	Decision Proposal 158 - Participant capability discovery

Future Plan

Review of Q4 and new changes: https://github.com/ConsumerDataStandardsAustralia/future-plan/projects/1

Iteration 9 Change Requests

All open change requests can be found here:

Data Standards CRs:

Maintenance Iteration Schedule

Maintenance Iteration 9 extended until 1st December 2021
Proposed that Maintenance Iteration commence 16th Feb 2022

Issues Consulted

The following issues have been consulted on during this iteration. The current status is summarised.

Standards Maintenance Issues

Source	#	Sector	Change Request	Status	Recommendation	Affected Schema (if applicable)	Affected Endpoint (if applicable)
Standards Maintenance	Issue 404	Banking	Profile scope not aligned with CX standards	DP216 is live	This issue will be consulted on in Decision Proposal 216 - Profile Scope Support given the breadth of the standards changes	N/A	ID Token OIDC UserInfo endpoint
Standards Maintenance	Issue 395	Does DHs' PAR endpoint require enabling private key jwt client authentication in addition to request object validation?	No change	No change	N/A	N/A
Standards Maintenance	Issue 397	Transaction Security Ciphers	Alternative supported	Defer to FAPI 1.0. The change proposed by the DSB to defer to FAPI standards will be included in the DP 209 consultation. Standards will be changed in accordance to the schedule for FAPI 1.0 adoption	N/A	N/A
Standards Maintenance	Issue 406	Change Request to make 'scope' optional in the token end-point response in FAPI	Not supported	Retain current requirement for scope support. Alignment to FAPI 1.0 (Final) requirements for the scope value will be included in the DP 209 consultation. Standards will be changed in accordance to the schedule for FAPI 1.0 adoption	N/A	oAuth Token endpoint
Standards Maintenance	Issue 150	A loan may have no end date but loanEndDate is mandatory	Supported - Breaking Change	Change `repaymentFrequency`, `loanEndDate` and `nextInstallmentDate` fields to be optional.	BankingLoanAccount	Get Account Details (v1 -> v2)
Standards Maintenance	Issue 396	Define new Digital Wallet Payee Type to relevant schemas	Supported - Breaking Change	Extend payee support for provider-agnostic digital wallets. Get Payees v2 and Get Payee Detail v2 future-dated obligation of 31st of March 2022. Data Holders can support v2 as early as is practical but no later than 31st of March 2022. Retirement of v1 APIs 1 month after v2 FDO (i.e., any time after 31st April 2022).	BankingPayee BankingPayeeDetail	Get Payees (v1 -> v2) Get Payee Detail (V1 -> v2)
Standards Maintenance	Issue 405	Alternative mechanisms for OTP	Under consultation	No recommendation yet made	N/A	N/A
Standards Maintenance	Issue 407	Align data quality NFR with Privacy Safeguard 11	Change supported	Changes to Data Quality NFRs working in line with OAIC feedback regarding data quality requirements in relation to Privacy Safeguard 11	N/A	N/A
Standards Maintenance	Issue 402	Support for multiple additional information documents	Change proposed; Under consultation	Proposes changes to supported multiple additional product documents	BankingProductV3	Get Products (v3 -> v4) Get Product Detail (v3 -> v4)
Standards Maintenance	Issue 401	Extending the list of supported feature types	Under consultation	Proposes changes to supported feature types	BankingProductFeature	Get Product Detail (v3 -> v4) Get Account Detail (v1 -> v2)
Standards Maintenance	Issue 291	Credit card loyalty program data: significant gaps and lack of structure	Under consultation	Proposes changes to better support loyalty schemes	BankingProductDetailV3 BankingAccountDetail	Get Product Detail (v3 -> v4) Get Account Detail (v1 -> v2)
Standards Maintenance	Issue 292	Credit card balance plans and payment hierarchy: inadequate information within the CDS	Under consultation	Proposes changes to supported multiple payment plans and balances	BankingProductDetailV3 BankingAccountDetail	Get Product Detail (v3 -> v4) Get Account Detail (v1 -> v2)
Standards Maintenance	Issue 391	Remove requirement for at least one address in physicalAddresses array	Under consultation	Proposed change to remove requirement of at least one address to be returned. Feedback from DHs has indicated that this is not always possible when the address held on record is invalid	CommonPersonDetail CommonOrganisationDetail	Get Customer Detail (v1 -> v2)
Standards Maintenance	Issue 423	Energy	Review of demand charges in energy billing transactions	Under consultation	-	-	-
Standards Maintenance	Issue 422	Energy	Energy C&I tariff extensions	Under consultation	-	-	-
Standards Maintenance	Issue 421	Energy	Review of rates in energy account payload	Under consultation	-	-	-
Standards Maintenance	Issue 420	Energy	Modification of energy account enumeration values	Under consultation	-	-	-
Standards Maintenance	Issue 419	Energy	Modification of energy billing and invoicing enumeration values	Under consultation	-	-	-
Standards Maintenance	Issue 432	Energy	EnergyPlanSolarFeedInTariff.tariffUType enum contains incorrect values	-	-	-
Standards Maintenance	Issue 428	InfoSec	CTS incorrectly implements Data Holder Initiated Revocation	For consultation	-	-	-
Standards Maintenance	Issue 426	InfoSec	Recipient Arrangement Revocation Endpoint exposed to Mixup Attack	For consultation	-	-	-
Standards Maintenance	Issue 428	InfoSec	CTS incorrectly implements Data Holder Initiated Revocation	For consultation	-	-	-
Standards Maintenance	Issue 424	Register	Change Request for Data Holder Multi-Sector support	For consultation	-	-	-
Standards Maintenance	Issue 425	Register	Change Request for Data Recipient Multi-Sector support	For consultation	-	-	-
Standards Maintenance	Issue 431	Register	Register participant statuses do not detail data holder behaviour when ADR is revoked and SP inactive	For consultation	-	-	-
Standards Maintenance	Issue 433	Register	Data Holder behaviour is not defined when a software product id goes "missing"	For consultation	-	-	-

CDR Register Maintenance Issues

Source	#	Change Request	Status	Recommendation	Affected Schema (if applicable)	Affected Endpoint (if applicable)
CDR Register	Issue 169	Update Register APIs to search for and differentiate between archived entities	Change supported	Documentation fixes. Staged and published after v1.13.0 release	N/A	N/A
CDR Register	Issue 189	RegisterDataHolderAuth schema in GetDataHolderBrands descriptions to be clarified	Change supported	Documentation fixes. Staged and published after v1.13.0 release	N/A	N/A
CDR Register	Issue 188	SSA definition: Deprecation of revocation_uri	Change supported	Documentation fixes. Staged and published after v1.13.0 release	N/A	N/A
CDR Register	Issue 186	Documentation improvement: JWT Signature verification requirements during the DCR flows	Change supported	Documentation fixes. Staged and published after v1.13.0 release	N/A	N/A
CDR Register	Issue 174	Update Register APIs to search for and differentiate between archived entities	Delayed	Carried over to next iteration	N/A	N/A
CDR Register	Issue 126	Consider changing statement in Certificate Management about the use of ACCC CA issued certificates for ADR end points	Delayed	To be consulted on under DP 211 threat modelling	N/A	N/A
CDR Register	Issue 123	Consider identicons to allow DHs to provide multiple attributes to map to individual accreditations	Under consultation	Requesting feedback. No recommendation has been made.	N/A	N/A
CDR Register	Issue 175	Publish an endpoint version schedule to document the introduction and deprecation of Register and DCR endpoints	Documentation enhancement	This will be covered with the merging of the CDR Register standards into the Consumer Data Standards. Deprecation schedules for various endpoint versions can then be discussed in future maintenance iterations	N/A	N/A