Specifications
The specifications
Three OpenID Foundation final specifications, one interoperability profile, and the IETF RFCs underneath them. All are developed in the open by the Shared Signals Working Group.
Final Shared Signals Framework 1.0
The framework everything else plugs into. Defines subject principals and identifiers, how SSF uses SETs, Transmitter discovery, the stream management API (create, read, update, delete, status, subjects, verification), and how push and poll delivery are profiled.
Final Continuous Access Evaluation Profile (CAEP) 1.0
Event types for continuously re-evaluating access during a session: session revoked, established and presented;
token claims change; credential change; assurance level change; device compliance change; and risk level change.
Also defines optional claims common to all CAEP events — event_timestamp, initiating_entity,
reason_admin and reason_user.
Final Risk Incident Sharing and Coordination (RISC) 1.0
Account-level events for coordinating responses to compromise across providers: credential compromise,
account disabled / enabled / purged, identifier changed or recycled, recovery activity, and opt-in/opt-out.
RISC's sessions-revoked is deprecated in favour of CAEP's session-revoked.
Draft 01 CAEP Interoperability Profile 1.0
Narrows the options in SSF and CAEP to a common baseline so independently built Transmitters and Receivers
work together out of the box: required discovery fields, push and poll delivery, OAuth with the
ssf.read / ssf.manage scopes, email and iss_sub subjects, RS256 signing,
and four use cases — session revocation, credential change, device compliance change and (new in the working copy)
risk level change. Draft 01 went to public review as a proposed Final in July 2026; in September the working group
chose to revise it and restart review. If you are building something new, start here.
Status at a glance
| Document | Status | Latest |
|---|---|---|
| Shared Signals Framework 1.0 | Final | 2025-08-29 — no changes since |
| CAEP 1.0 | Final | 2025-08-29 — no changes since |
| RISC 1.0 | Final | 2025-08-29 — no changes since |
| CAEP Interoperability Profile 1.0 | Proposed Final — being revised; public review to restart | Draft 01 July 2026; working copy adds Risk Level Change (2026-09-01) |
Checked against openid/sharedsignals @ a34d6ff (2026-09-01) on 2026-10-13.
The repository also holds older, inactive drafts (OAuth Event Types, RISC use cases, subject identifier scenarios) that are not covered here.
Working copies of everything are published at openid.github.io/sharedsignals.
Underlying IETF standards
| RFC | Title | Role in SSF |
|---|---|---|
| RFC 8417 | Security Event Token (SET) | The JWT format every SSF event is carried in. |
| RFC 8935 | Push-Based SET Delivery Using HTTP | Transmitter POSTs SETs to the Receiver. |
| RFC 8936 | Poll-Based SET Delivery Using HTTP | Receiver polls the Transmitter and acknowledges SETs. |
| RFC 9493 | Subject Identifiers for Security Event Tokens | The email / iss_sub / opaque / … subject formats. |
| RFC 7519 | JSON Web Token (JWT) | The token format underneath SETs. |
| RFC 6749 | OAuth 2.0 | The usual way Receivers authorise to the stream management API. |
Following the work
- Working group home: openid.net/wg/sharedsignals
- Spec sources, issues and pull requests: github.com/openid/sharedsignals