Require Authentication for Metrics Endpoints

[quicklywilliam]

---

name: William Henderson
title: Require Authentication for Metrics Endpoints

---

Explain pull request

This PR implements changes based on the recommendation of the Privacy Committee. A member of the committee will follow up with a comment containing a link to our full recommendation.

Is this a breaking change

Yes, though would break existing implementations of Metrics (if any exist).

Impacted Spec

Metrics

[CLAassistant]

All committers have signed the CLA.

[schnuerle]

If an agency does decide to publicly release data from the /aggregate endpoint, would it then be some other non-CDS method?

The new wording does have this language:

In the meantime, agencies wishing to publicly release Metrics data are encouraged to limit releases to static Aggregate data that has been reviewed for potential privacy risks. Consult our Privacy Guidance for more details.

So yes an agency would have to publish any exported data in their own way outside of CDS.

[schnuerle]

Added a beta language sentence and link to the proposed Metrics Authorization section. Making this beta was part of the Privacy Committee's recommendation, so this would need to be included in the spec.

[schnuerle]

The OMF Privacy Committee's recommendation in this PR was approved by the OMF Board during the release approval process, so this change is being added to the CDS 1.0 Release Candidate.