> For the complete documentation index, see [llms.txt](https://docs.inrupt.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.inrupt.com/ess/3.0/releases/changelog.md).

# 3.0 Changelogs

## v3.0.0

Released: 2026-05-27

### New features

#### **Native Identity Provider Support**

ESS now supports direct integration with external OIDC-compliant Identity Providers. Clients authenticate with their existing IdP and exchange the resulting token for an ESS Access Token via a token exchange endpoint hosted by the Platform Management service. The ESS OpenID Broker is no longer required as an intermediary.

#### **Identifiers**

Permanent, globally unique identifiers for storages, resources, agents, and clients. Resources are now accessible via canonical URIs (`{storage-id}/sc/{resource-id}`) alongside path-based URIs (`{storage-id}/sp/{resource-path}`). ESS identifiers mitigate PII leakage and provide durable references for Access Grants, notifications, and AI agent context.

#### **Environment Isolation**

Each ESS service can operate within its own named PostgreSQL database schema. This provides deployment flexibility — all services can connect to a single database instance, or separate database instances can be used for each service.

#### **Unified User Provisioning**

All user provisioning — including account creation, WebID management, and storage allocation — is handled through the Platform Management service. New user registration APIs, identity mapping admin APIs, and agent account endpoints.

### Breaking changes

#### **UMA Service Removed**

The UMA service has been removed. Access Grants now serve as receipts — once the resource owner approves an Access Grant, the recipient can retrieve the granted resources directly using their ESS Access Token. ESS checks the grant server-side, so no UMA negotiation or additional token exchange is needed. This simplifies the access flow and reduces client code complexity. Remove all UMA token exchange logic from client applications.

#### **Query/QPF (Fragments) Service Removed**

The Query/QPF service has been removed. These capabilities are being replaced with new search capabilities.

#### **WebSocket Notification Service Removed**

The WebSocket Notification Service has been removed. Use the Notification Delivery Service.

#### **Notification Gateway Service Removed**

The Notification Gateway Service has been removed.

#### **Wallet Service Removed**

The Wallet Service has been removed.

#### **Provisioning Flow Changed**

All user provisioning (accounts, WebIDs, and storage) is now handled through the Platform Management service. The Pod Provisioning Service and WebID Service endpoints are no longer called directly by clients. Update start applications and onboarding flows to use the [Platform Management API](/ess/3.0/services/service-platform-management/platform-management-api.md).

#### **Authentication Flow Changed**

Clients must now authenticate with an external Identity Provider and exchange the resulting ID token for an ESS Access Token via the token exchange endpoint on the Platform Management service. The ESS OpenID Broker is no longer required as an intermediary.

#### **Access Grants Decoupled from ACP**

Access Grants no longer require ACP policies to enable their use. Once a resource owner approves an Access Grant, the recipient can access the resource directly. The `INRUPT_AUTHORIZATION_DEFAULT_ACR_ACCESS_GRANTS_ALLOWED_MODES` configuration and the VC Matcher policies in the initial Pod ACR are no longer needed.

#### **Canonical URIs Required for Access Grants and Notifications**

Access Grant issuing and notification subscriptions must use canonical resource URIs (the `/sc/` form). This is so access is more stable and secure. Path-based URIs continue to work for direct resource access.

#### **Audit Events Updated**

Audit events now include identifiers for all referenced resources.