Directory is a participant registry for Open Finance and other Open X ecosystems.
It validates each institution through a live mutual TLS and dynamic client registration check, then publishes certificates, authorisation servers and software statements through a public, versioned API.
/How it works
01
Prove it
Self-registration triggers a live mutual TLS request to the institution's declared dynamic client registration endpoint (RFC 7591), presenting a certificate issued by Directory's own CA and a signed software statement — plus a live GET against the institution's JWKS endpoint. Nothing is accepted on declaration alone.
02
Get listed
Once both checks pass, the institution's authorisation servers, X.509 certificates and software statements are published through a public, versioned API — the same one every other participant and any ecosystem client reads from.
03
Anyone resolves it
A single unauthenticated GET request is enough for another participant, or the ecosystem's own software, to resolve a participant's certificates and capabilities. No hardcoded allow-list, no manual lookup.
/Capabilities
Participant registry
Organisations, authorisation servers, certificates and software statements — published through a public, versioned API, not a document handed around by email.
Certificate authority
Directory runs its own CA. X.509 certificates are issued, rotated and revoked — never just declared in a registration form.
Dynamic client registration
Functional validation makes a real RFC 7591 call against each participant's declared registration endpoint before activation, alongside a live JWKS fetch.
Sender-constrained tokens
Sessions and service credentials can be bound to a client certificate's SHA-256 thumbprint (RFC 8705). Once bound, a leaked bearer token alone is not enough to authenticate.
Self-service console
A browser-based console for day-to-day administration — certificates, authorisation servers, claims, webhooks, users — the same public API, no client to write.
Security
Passkeys (WebAuthn) alongside passwords, and a durable, queryable audit trail of every write — who did what, and when.