openid / openid/authzen

Metadata parameter is named `capabilities` in §9.1.2 but referenced as `supported_capabilities` in §8.2.2

Open
#601 0 comments 1 reaction 3 assignees View on GitHub

@tulshi is already working on this.

Since Aug 1, 2026.

authorization-api errata
Dominant language
TypeScript
Stars
160
Forks
40
Avg merge
2d 3h
Merged PRs (30d)
23

Description

§9.1.2 defines the PDP metadata parameter as capabilities
(api/authorization-api-1_0.md line 1303). §8.2.2 refers to it by a
different name at line 949:

Furthermore, the PDP MUST declare support for the corresponding capability
URN in its supported_capabilities metadata
({{pdp-metadata-data-capabilities}}).

The cross-reference at the end of that sentence resolves to the section that
defines it as capabilities.

Worth fixing rather than leaving to the reader, because §8.2.2 is the only
place in the spec that states a MUST to populate the parameter. §9.1.2 just
says it's OPTIONAL and what it holds. So the wrong name is on the normative
sentence.

supported_capabilities appears nowhere else in the repo, and the ARAP
profile already uses capabilities. Suggested fix at line 949:

-Furthermore, the PDP MUST declare support for the corresponding capability URN in its `supported_capabilities` metadata ({{pdp-metadata-data-capabilities}}).
+Furthermore, the PDP MUST declare support for the corresponding capability URN in its `capabilities` metadata ({{pdp-metadata-data-capabilities}}).

Present in 1.0 final (11 January 2026) and in the current editor's draft.

Seems like we should discuss an errata process.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.