ConsumerDataStandardsAustralia / standards-maintenance

This repository houses the interactions, consultations and work management to support the maintenance of baselined components of the Consumer Data Right API Standards and Information Security profile.
41 stars 9 forks source link

NFR: Secondary Data Holder unable to determine Customer Present #602

Open perlboy opened 11 months ago

perlboy commented 11 months ago

Description

The Shared Responsibility for Energy section specifies:

The x-fapi-customer-ip-address header MUST NOT be passed to AEMO and AEMO MUST NOT require this header

While the definition of this header states:

The customer's original IP address if the customer is currently logged in to the Data Recipient Software Product. The presence of this header indicates that the API is being called in a customer present context. Not to be included for unauthenticated calls.

Meanwhile the NFRs state that there are different SDH Performance Requirements are variable for certain present vs. not present calls:

image

Primary Data Holders therefore end up in a situation where Customer Present calls are effectively all Unattended threshold for the SDH. This creates a situation where the primary and secondary data holders do not have aligned expectations resulting in misaligned statistical expectations and consequential reporting characteristics.

Note: I've created this pretty quickly for consideration in this MI and therefore have not had a chance to pass this through Biza.io's Data Standards Committee.

Area Affected

Change Proposed

Introduce an x-cds-customer-present header with a boolean true/false value for all calls to Secondary Data Holders

johnAEMO commented 10 months ago

Feedback from AEMO and reflections on recent conversations during the previous maintenance iteration call:

nils-work commented 16 hours ago

Hi @perlboy

Re: your proposal for the inclusion of the x-cds-customer-present header (although there was a suggestion it may not be required for Energy), I've noted that FAPI 2.0 Implementation Advice suggests what could be an equivalent - x-fapi-end-user-present.

While this topic has been discussed before do you feel there would still be a preference to align to FAPI headers or to develop CDS headers for CDR requirements?

This could include where a correlation ID may be helpful for endpoints that don't currently have x-fapi-interaction-id specified, such as Get Metrics.