finnest opin

Verify OPIN provider-DCR readiness and emit the conformance suite test-plan config.

Run the OPIN acceptance ladder: build the sanitized provider-DCR target report (must show zero warnings), then probe DCR registration over mTLS when BRCAC + SSA material is provided, then — when Directory coordinates are given (--org-id/--as-id/--brcac-cert/--brcac-key) — confirm the registered Directory Authorisation Server record still points at the deployed realm with DCR enabled. Without material the probe is reported as skipped — pass --allow-skip to accept that explicitly; 201 means registered, 409 means this software_id is already registered.

Examples

finnest opin status

finnest opin status --json

finnest opin verify

finnest opin verify --allow-skip

finnest opin verify --brcac-cert ./brcac.pem --brcac-key ./brcac.key --ssa-file ./ssa.jwt

finnest opin verify --org-id ORG --as-id AS --directory-client-id CLIENT --brcac-cert ./brcac.pem --brcac-key ./brcac.key

finnest opin conformance --emit-plan

finnest opin conformance --emit-plan --auth-method tls_client_auth --out ./conformance-plan.json

Options

• --auth-base <url> — Authorization server base URL (non-mTLS host) for the OPIN target report.
• --matls-auth-base <url> — Regulated mTLS authorization host base URL (matls-auth.<domain>).
• --realm <realm> — Authorization realm for the OPIN target report (default finnest-opin).
• --brcac-cert <path> — Path to the BRCAC client certificate PEM used for mTLS.
• --brcac-key <path> — Path to the BRCAC client key PEM used for mTLS.
• --ssa-file <path> — Path to a compact SSA JWT file for dcr ssa-summary.
• --ssa-env <name> — Name of an environment variable holding the compact SSA JWT.
• --ca-bundle <path> — Optional extra CA bundle PEM trusted for the mTLS endpoints.
• --allow-skip — Accept a skipped DCR probe (no BRCAC/SSA material) as a passing opin verify.
• --org-id <id> — Directory organisation id used to build the SSA endpoint path.
• --as-id <id> — Directory Authorisation Server id used to check the registered AS record.
• --directory-base <url> — OPIN Directory mTLS API base; token endpoint comes from issuer discovery.
• --directory-client-id <id> — Optional Directory token client ID override; defaults to the selected software ID.
• --environment <environment> — Target environment: sandbox or prod.
• --json — Emit a schema-versioned JSON envelope to stdout.
• --output <format> — Select text, json, or ndjson output.
• --no-color — Disable ANSI color without changing the output content mode.
• --no-evidence — Do not write .finnest run evidence.
• --verbose — Enable debug-level diagnostics.

Subcommands

• verify — Target report (zero warnings) + mTLS DCR probe (201/409).
• conformance — Emit the OIDF conformance suite test-plan config, prefilled from live discovery.
• status — Readiness board — the material → deploy → hardening → Directory → SSA → DCR ladder.
• directory — Read-only OPIN Directory introspection over your BRCAC: link / diff / certs.