Financial-grade API (FAPI)

​

What is FAPI?

FAPI, being standardized by a working group under the OpenID Foundation, is a standard for secure and interoperable API communication. Beyond the financial industry, it plays an important role in sectors that demand a high level of security, such as healthcare and e-government. FAPI builds on OAuth 2.0 and OpenID Connect. It started with FAPI 1.0 and has since evolved into FAPI 2.0, the current version. FAPI 2.0 adopts newer protocols to protect data more securely, while being simpler to implement than FAPI 1.0.

​

FAPI Security Profiles

Among those specifications, the FAPI Security Profiles can be applied to online services in any sector, not only financial services, that requires a higher level of security than standard OAuth or OpenID Connect provides. There are two of them, FAPI 1.0 and FAPI 2.0, and Authlete supports both.

​

FAPI 1.0

FAPI 1.0 is split into two parts.

• Financial-grade API Security Profile (FAPI) 1.0 – Part 1: Baseline A baseline security profile of OAuth that is suitable for protecting APIs with a moderate inherent risk
• Financial-grade API Security Profile (FAPI) 1.0 – Part 2: Advanced An advanced security profile of OAuth that is suitable for protecting APIs with high inherent risk, such as those giving access to highly sensitive data, or triggering financial transactions (e.g., payment initiation)

The latter one, “FAPI Part 2,” provides higher security measures by leveraging advanced features defined in OpenID Connect specifications in addition to OAuth standards. Here are some notable enhancements:

• Prevention of sender impersonation and message tampering in terms of authorization request and response
  • Using request object
  • Using hybrid flow or JARM
• Prevention of leakage and unauthorized use of authorization code
  • Strict checking of Redirect URI (redirect_uri)
• Prevention of client impersonation
  • Client authentication with mutual TLS client authentication or JWT
• Prevention of unauthorized use of tokens
  • Certificate-bound access tokens

​

FAPI 2.0

FAPI 2.0 is a comprehensive framework for raising API security. It breaks down into the following four components.

• FAPI 2.0 Security Profile The core profile of FAPI 2.0. It makes use of recent security specifications such as PAR and DPoP
• FAPI 2.0 Message Signing Profile A profile that adds a non-repudiation mechanism to requests and responses based on OAuth 2.0
• FAPI 2.0 Attacker Model Defines the potential risks to API security and the measures that prevent them
• Grant Management for OAuth 2.0 Extends OAuth 2.0 with a mechanism for managing the grants given to a client application

The following documents and slides might help you understand FAPI.

1. A Comprehensive Commentary on Financial-grade API This white paper describes technical details on Financial-grade API (FAPI) security profiles on a line-by-line basis, and how Authlete implements FAPI to enable flexibile deployment.

​

Authlete and FAPI

Authlete has supported Financial-grade API since July 2018 and has been certified since April 2019. Here are useful resources that help you understand how you can build a FAPI-compliant authorization server with Authlete.

• Authlete FAPI Enhancements The session explains comparison of Authlete’s unique semi-hosted approach and traditional approaches for deploying OAuth infrastructure, and how Authlete has extended its client authentication functions and supported mutual TLS to implement Financial-grade API (FAPI).
• How to use FAPI feature How Authlete decides which profile to apply, for both FAPI 1.0 and FAPI 2.0. It is also the entry point to the page that covers each profile in detail.
• Financial-grade API (FAPI) Basics A tutorial to configure Authlete to build a Financial-grade API (FAPI) compliant authorization server.