Overview

The Open Finance UAE API Security Standards is comprised of three documents, the Security Profile, the Registration Framework and the Certificate Standard, that aim to provide specific implementation guidelines for security and interoperability which can be applied to APIs in the Open Finance UAE ecosystem.

The Registration Framework and the Security Profile are extensions of standards developed by the OpenID Foundation Working Groups, notably the OIDC Federation and the FAPI 2.0, which have been streamlined to facilitate implementation and reduce interoperability concerns for the Open Finance UAE Participant. This section includes the Security Standards Documents and all the Related Materials created for the CBUAE Project.

The Security Standards include the following documents :

• /wiki/spaces/Internal/pages/26869805: Defines the ways that an accredited institution (Data Receiver) can use to authenticate itself to access protected resource endpoints from the Data Provider, as well as receive authorization from a customer to access their personal data.

• /wiki/spaces/Internal/pages/27361324: Defines the technical ways for the participating institutions to register their organizations by leveraging a trust framework. Defines how participants can confirm the identity of other participating institutions and what access scope they have within the ecosystem.

• /wiki/spaces/Internal/pages/27361335: Specifies the set of necessary certificates required by organizations participating in Open Finance UAE to ensure the interoperability for authentication, confidentiality of data, integrity and non-repudiation among participants, as well as for users and consumers of these entities.

Details about the agreed delivery timelines can be found on : https://raidiam.sharepoint.com/:x:/r/sites/Delivery-CBUAE/_layouts/15/Doc.aspx?sourcedoc=%7BBEEAA92E-A6E7-4150-A9A9-09EEA28BC625%7D&file=240123_Standards%20Development%20Plan_v3_ED.xlsx&action=default&mobileredirect=true