> For the complete documentation index, see [llms.txt](https://docs.inrupt.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.inrupt.com/ess/3.0/releases.md).

# Release Notes

## ESS 3.0.0 (Released 2026-05-27)

ESS 3.0 is a major release that introduces native Identity Provider support, permanent resource identifiers, simplified Access Grant flows, and environment isolation.

### Native Identity Provider Support

ESS now supports direct integration with external OIDC-compliant Identity Providers. Clients authenticate with their existing IdP and exchange the resulting token for an ESS Access Token via a token exchange endpoint hosted by the [Platform Management service](/ess/3.0/services/service-platform-management/token-exchange.md). The ESS OpenID Broker is no longer required as an intermediary.

### Identifiers

ESS assigns permanent, globally unique identifiers to storages, resources, agents, and clients. Resources are now accessible via canonical URIs (`{storage-id}/sc/{resource-id}`) in addition to path-based URIs (`{storage-id}/sp/{resource-path}`). Access Grant issuing and notification subscriptions must use canonical URIs so that access is more stable and secure.

### Simplified Access Grant Flow

The UMA service has been removed. Access Grants now serve as receipts — once the resource owner approves an Access Grant, the recipient can retrieve the granted resources directly using their ESS Access Token. ESS checks the grant server-side, so no UMA negotiation or additional token exchange is needed. Additionally, Access Grants are now fully independent of ACP — no VC Matcher policies or ACP enablement configuration is required. This simplifies the access flow, reduces client code complexity, and eliminates a common source of hidden authorization failures.

### Environment Isolation

Each ESS service can operate within its own named PostgreSQL database schema. This provides deployment flexibility — all services can connect to a single database instance, or separate database instances can be used for each service.

### Unified User Provisioning

All user provisioning — including account creation, WebID management, and storage allocation — is handled through the [Platform Management service](/ess/3.0/services/service-platform-management/platform-management-api.md). The Pod Provisioning Service and WebID Service endpoints are no longer called directly by clients.

### Removed Services

The following services have been removed in ESS 3.0:

* **UMA Service**: Replaced by simplified Access Grant flow with direct resource access
* **Query/QPF (Fragments) Service**: Being replaced with new search capabilities
* **Notification Gateway Service**: Removed
* **WebSocket Notification Service**: Removed; use the Notification Delivery Service

## Changelogs

For changelogs, see [3.x Changelogs](/ess/3.0/releases/changelog.md).