Cross Domain · protocol · OpenID Foundation — Shared Signals working group

OpenID Shared Signals Framework (SSF), CAEP and RISC

The Shared Signals Framework is an OpenID Foundation specification for asynchronous, privacy-protected security webhooks between a Transmitter and a Receiver — a standard way for one service to tell another that a session was revoked, a credential changed, a device fell out of compliance, or an account was compromised. Two profiles build on it — the Continuous Access Evaluation Protocol (CAEP) for zero-trust session and device events, and Risk Incident Sharing and Coordination (RISC) for account takeover and credential compromise. All three reached Final Specification status on 2 September 2025.

openid.net/wg/sharedsignals/The standard

OpenID Foundation — Shared Signals working groupGoverning body

2021First published

Final Specification, approved 2 Septe...Current version

Yes — Security Event Tokens (JWT) wit...Machine-readable schema · open

0providers in the catalog

Also known as SSF, Shared Signals, CAEP, Continuous Access Evaluation Protocol, RISC, Risk Incident Sharing and Coordination, Shared Signals and Events.

Providers that carry Shared Signals Framework 0

No provider in the catalog carries this standard as a tag yet. That is a statement about the catalog's tagging, not about adoption: a provider that implements Shared Signals Framework and says so in its APIs.json profile appears here on the next build. Add or correct a listing.

Read from the API Evangelist standards directory, facts verified 2026-08-24. Provider links come from the catalog's own identity tags and are rebuilt nightly. If this page is wrong about a standard or a provider, say so.