Issues

• DC: implement ESPI Batch/Bulk API — Third Party client access token only, scoped to its own Authorizations

  enhancementNAESB ESPI Standard
  GreenButtonAlliance/OpenESPI-GreenButton-Java#256 · Filter by author dfcoffin opened on Nov 14, 2026

• Roadmap: operational, manually testable AS / DC / TP — prioritized open issues

  task
  GreenButtonAlliance/OpenESPI-GreenButton-Java#255 · Filter by author dfcoffin opened on Nov 14, 2026
  1

• DC local profile: seed a deterministic ESPI sample dataset (customer, usage, PII, ApplicationInformation) for manual testing

  enhancement
  GreenButtonAlliance/OpenESPI-GreenButton-Java#253 · Filter by author dfcoffin opened on Nov 14, 2026

• Third Party: register itself via RFC 7591 dynamic client registration and manage its registration

  enhancement
  GreenButtonAlliance/OpenESPI-GreenButton-Java#252 · Filter by author dfcoffin opened on Nov 14, 2026

• Registration access token: issue it on RFC 7591 registration, renew via FB=36_40, and require it for ApplicationInformation

  enhancement
  GreenButtonAlliance/OpenESPI-GreenButton-Java#251 · Filter by author dfcoffin opened on Nov 14, 2026
  3

• Third Party: add a username/password login page matching the Data Custodian login design

  enhancement
  GreenButtonAlliance/OpenESPI-GreenButton-Java#249 · Filter by author dfcoffin opened on Nov 14, 2026

• DC customer portal: implement usage points, Download My Data and the legacy customer home (or retire them)

  enhancement
  GreenButtonAlliance/OpenESPI-GreenButton-Java#245 · Filter by author dfcoffin opened on Nov 14, 2026

• Make Flyway the single schema owner in every app and profile (H2 included); fix drifted/missing migration locations

  enhancementinfrastructure
  GreenButtonAlliance/OpenESPI-GreenButton-Java#241 · Filter by author dfcoffin opened on Nov 14, 2026

• Security: triage the open CodeQL code-scanning alerts on main

  bug
  GreenButtonAlliance/OpenESPI-GreenButton-Java#237 · Filter by author dfcoffin opened on Nov 14, 2026

• AS: H2 migrations lack oauth2_client_metrics / oauth2_consent_details / oauth2_token_usage (scheduled metrics job fails on local profile)

  bug
  GreenButtonAlliance/OpenESPI-GreenButton-Java#234 · Filter by author dfcoffin opened on Nov 14, 2026

• AS: authorization-server metadata advertises jwks_uri and JWT client-auth methods that don't exist (opaque-only AS)

  bug
  GreenButtonAlliance/OpenESPI-GreenButton-Java#233 · Filter by author dfcoffin opened on Nov 14, 2026

• AS: unauthenticated /oauth2/authorize redirects to /authorize/delegate without parameters (400); outbound delegation to DC is broken

  blockingbug
  GreenButtonAlliance/OpenESPI-GreenButton-Java#232 · Filter by author dfcoffin opened on Nov 14, 2026

• AS: unauthenticated POST to /oauth2/token, /introspect, /revoke gets 302 to /authorize/delegate instead of 401

  bug
  GreenButtonAlliance/OpenESPI-GreenButton-Java#225 · Filter by author dfcoffin opened on Nov 13, 2026

• AS/DC: customer scope narrowing yields invalid_scope on authorize replay

  enhancementNAESB ESPI Standard
  GreenButtonAlliance/OpenESPI-GreenButton-Java#211 · Filter by author dfcoffin opened on Nov 13, 2026

• AS: admin user store with form login + passkey (WebAuthn) MFA, env bootstrap, and admin-user API

  enhancement
  GreenButtonAlliance/OpenESPI-GreenButton-Java#205 · Filter by author dfcoffin opened on Nov 12, 2026

• AS admin APIs: client_credentials bearer-token authentication (opaque, introspected in-process)

  enhancement
  GreenButtonAlliance/OpenESPI-GreenButton-Java#204 · Filter by author dfcoffin opened on Nov 12, 2026

• Conditional: RFC 7592-style registration management (registration_access_token, read/update) for ESPI FB_36/FB_40

  enhancementNAESB ESPI Standard
  GreenButtonAlliance/OpenESPI-GreenButton-Java#203 · Filter by author dfcoffin opened on Nov 12, 2026

• ESPI token-response URIs: FB_51 gating, re-provisioning on refresh, missing URIs for client_credentials tokens

  bugNAESB ESPI Standard
  GreenButtonAlliance/OpenESPI-GreenButton-Java#202 · Filter by author dfcoffin opened on Nov 12, 2026
  2

• AS: existing oauth2_audit_log writers fail silently on MySQL/PostgreSQL (non-JSON additional_data, missing JSONB cast)

  bug
  GreenButtonAlliance/OpenESPI-GreenButton-Java#200 · Filter by author dfcoffin opened on Nov 12, 2026

• AS: abandoned authorization requests (no token, no expiry) accumulate in oauth2_authorization

  enhancement
  GreenButtonAlliance/OpenESPI-GreenButton-Java#199 · Filter by author dfcoffin opened on Nov 12, 2026

• Third Party cannot unmarshal any ESPI Atom feed (AtomFeedDto date adapters + abstract entry type)

  bug
  GreenButtonAlliance/OpenESPI-GreenButton-Java#197 · Filter by author dfcoffin opened on Nov 12, 2026
  1

• Remove or fix skipped / @Disabled / CI-excluded tests across modules

  task
  GreenButtonAlliance/OpenESPI-GreenButton-Java#194 · Filter by author dfcoffin opened on Nov 12, 2026

• TLS certificates for the Data Custodian, Third Party and Authorization Server deployments: one single-host certificate per service, no wildcard

  infrastructuretask
  GreenButtonAlliance/OpenESPI-GreenButton-Java#188 · Filter by author dfcoffin opened on Nov 2, 2026

• E1: DC resource engine + Atom entry-assembly (GET-first) — UsagePoint & Customer verticals, scope-enforced

  ESPI 4.0NAESB ESPI Standardschema-compliancetask
  GreenButtonAlliance/OpenESPI-GreenButton-Java#187 · Filter by author dfcoffin opened on Jun 11, 2026

• Authorization Server: add a home/landing page (no AS home screen exists today)

  GreenButtonAlliance/OpenESPI-GreenButton-Java#186 · Filter by author dfcoffin opened on Jun 9, 2026