Explicitly declare the base URI for SSF event types

Summary

The SSF 1.0 specification defines two SSF-specific event types:

• https://schemas.openid.net/secevent/ssf/event-type/verification
• https://schemas.openid.net/secevent/ssf/event-type/stream-updated

Both event type URIs use the common prefix:

https://schemas.openid.net/secevent/ssf/event-type/

However, SSF does not explicitly declare this prefix as the base URI for SSF event types.

Background

The related CAEP and RISC event profile specifications explicitly declare the base URI used for their event types.

For example, CAEP 1.0 Section 3 states:

The base URI for CAEP event types is:

https://schemas.openid.net/secevent/caep/event-type/

RISC 1.0 Section 2 similarly declares:

The base URI for RISC event types is:

https://schemas.openid.net/secevent/risc/event-type/

SCIM Events also defines a common event URN namespace in RFC 9967 Section 7.3.

SSF already follows the same general naming convention for its stream-related event types, but the common base URI is currently only implicit.

Proposal

Add an explicit declaration to the SSF specification, close to the definitions of the SSF-specific event types.

Suggested text:

The base URI for SSF event types is:

https://schemas.openid.net/secevent/ssf/event-type/

Optionally, SSF could introduce a dedicated subsection for SSF event types and list the currently defined event types:

• verification
• stream-updated

Rationale

This change would:

• document the common namespace already used by SSF-defined events;
• align SSF with the conventions used by CAEP and RISC;
• make the namespace easier for implementers to discover;
• provide a clearly defined namespace for potential future SSF-level events;
• avoid requiring readers to infer the base URI from individual event type definitions.

This would be an editorial clarification only. It would not change any existing event type URI or protocol behavior.

Locate the SSF specification section defining the verification and stream-updated event types. Add the proposed base-URI declaration near those definitions, then verify that the existing event type URIs remain unchanged and that the specification renders consistently.