Released: 2026-05-27
ESS now supports direct integration with external OIDC-compliant Identity Providers. Clients authenticate with their existing IdP and exchange the resulting token for an ESS Access Token via a token exchange endpoint hosted by the Platform Management service. The ESS OpenID Broker is no longer required as an intermediary.
Permanent, globally unique identifiers for storages, resources, agents, and clients. Resources are now accessible via canonical URIs ({storage-id}/sc/{resource-id}) alongside path-based URIs ({storage-id}/sp/{resource-path}). ESS identifiers mitigate PII leakage and provide durable references for Access Grants, notifications, and AI agent context.
Each ESS service can operate within its own named PostgreSQL database schema. This provides deployment flexibility — all services can connect to a single database instance, or separate database instances can be used for each service.
All user provisioning — including account creation, WebID management, and storage allocation — is handled through the Platform Management service. New user registration APIs, identity mapping admin APIs, and agent account endpoints.
The UMA service has been removed. Access Grants now serve as receipts — once the resource owner approves an Access Grant, the recipient can retrieve the granted resources directly using their ESS Access Token. ESS checks the grant server-side, so no UMA negotiation or additional token exchange is needed. This simplifies the access flow and reduces client code complexity. Remove all UMA token exchange logic from client applications.
The Query/QPF service has been removed. These capabilities are being replaced with new search capabilities.
The WebSocket Notification Service has been removed. Use the Notification Delivery Service.
The Notification Gateway Service has been removed.
The Wallet Service has been removed.
All user provisioning (accounts, WebIDs, and storage) is now handled through the Platform Management service. The Pod Provisioning Service and WebID Service endpoints are no longer called directly by clients. Update start applications and onboarding flows to use the Platform Management API.
Clients must now authenticate with an external Identity Provider and exchange the resulting ID token for an ESS Access Token via the token exchange endpoint on the Platform Management service. The ESS OpenID Broker is no longer required as an intermediary.
Access Grants no longer require ACP policies to enable their use. Once a resource owner approves an Access Grant, the recipient can access the resource directly. The INRUPT_AUTHORIZATION_DEFAULT_ACR_ACCESS_GRANTS_ALLOWED_MODES configuration and the VC Matcher policies in the initial Pod ACR are no longer needed.
Access Grant issuing and notification subscriptions must use canonical resource URIs (the /sc/ form). This is so access is more stable and secure. Path-based URIs continue to work for direct resource access.
Audit events now include identifiers for all referenced resources.
Last updated
