Content for &nbsp; TS 23.222 &nbsp; Word version:&nbsp; 19.1.0

The CAPIF core function decides to revoke subscription of CAPIF event(s) for the subscribing entity.

The CAPIF core function sends subscription revoke notification to the subscribing entity.

Figure 8.10.3-1: Procedure for authentication between the API invoker and the CAPIF core function

The subscribing entity provides a subscription revoke notification acknowledgement to the CAPIF core function.

8.10 Authentication between the API invoker and the CAPIF core function p. 59

8.10.1 General p. 59

The procedure in this subclause corresponds to the architectural requirements for authentication between the API invoker and the CAPIF core function.

8.10.2 Information flows p. 59

8.10.3 Procedure p. 59

Figure 8.10.3-1 illustrates the procedure for authentication between the API invoker and the CAPIF core function.

Pre-condition:

The API invoker is onboarded with the CAPIF core function and the API invoker profile is created.

Reproduction of 3GPP TS 23.222, Fig. 8.10.3-1: Procedure for authentication between the API invoker and the CAPIF core function

The API invoker triggers authentication to the CAPIF core function, including the identity confirmed after successful onboarding.

Upon receiving the authentication request, the CAPIF core function verifies the identity with the API invoker profile and authenticates the API invoker.

Figure 8.11.3-1: Procedure for the API invoker obtaining authorization for service API access

The CAPIF core function returns the result of the API invoker identity verification in the authentication response.

8.11 API invoker obtaining authorization to access service API p. 60

8.11.1 General p. 60

The API invoker requires to execute this procedure when it needs to obtain or re-obtain (e.g. upon expiry of the authorization information) the authorization to access the service API. Once the API invoker receives the authorization to access the service API, the API invoker can perform one or multiple service API invocations as per the permission limit. This procedure may be performed during the API invoker onboarding process.

8.11.2 Information flows p. 60

8.11.3 Procedure p. 60

Figure 8.11.3-1 illustrates the procedure for obtaining authorization to access the service API.

Pre-condition:

The API invoker is onboarded and has received an API invoker identity.

Reproduction of 3GPP TS 23.222, Fig. 8.11.3-1: Procedure for the API invoker obtaining authorization for service API access

The API invoker sends an obtain service API authorization request to the CAPIF core function for obtaining permission to access the service API by including the API invoker identity information and any information required for authentication of the API invoker. The request may include desired Network Slice Info of the service API.

The CAPIF core function validates the authentication of the API invoker (using authentication information) and checks whether the API invoker is permitted to access the requested service API. The CAPIF core function may additionally verify the Network Slice Info, e.g., check that the desired Network Slice Info by the API invoker is included in the supported Network Slice Info for the indicated service API.

Table 8.12.2.1-1: Obtain access control policy request

Based on the API invoker's subscription information the authorization information to access the service APIs is sent to the API invoker in the obtain service API authorization response.

8.12 AEF obtaining service API access control policy p. 61

8.12.1 General p. 61

The CAPIF core function is the central repository of all the policies related to service APIs. The AEF executes this procedure when it needs to obtain the policy to perform access control on the service API invocations (e.g. when policy for performing access control on service API is unavailable at the AEF). The AEF can be within PLMN trust domain or within 3rd party trust domain.

8.12.2 Information flows p. 61

8.12.2.1 Obtain access control policy request p. 61

Table 8.12.2.1-1 describes the information flow obtain access control policy request from the AEF to the CAPIF core function.

Information Element	Status	Description
Identity information	M	Identity information of the entity requesting the access control policy
Service API identification	M	The identification information of the service API for which the access control policy is being requested.

8.12.2.2 Obtain access control policy response p. 61

Table 8.12.2.2-1 describes the information flow obtain access control policy response from the CAPIF core function to the AEF.

Table 8.12.2.2-1: Obtain access control policy response

Information Element	Status	Description
Result	M	Indicates the success or failure of the obtain access control policy operation
Access control policy information	O (1)	The access control policy information corresponding to the requested service API. (See Table E-1).
NOTE 1: Shall be present if the Result information element indicates that the obtain access control policy operation is successful. Otherwise access control policy information shall not be present.

8.12.3 Procedure p. 61

Figure 8.12.3-1 illustrates the procedure for obtaining policy to perform access control on the service API invocations.

Pre-conditions:

The AEF is hosting the service API but the policy to perform access control is not available with AEF.
The CAPIF core function is configured with the access control policies corresponding to one or more service APIs.
Authorization details of the AEF are available with the CAPIF core function.

Reproduction of 3GPP TS 23.222, Fig. 8.12.3-1: Procedure for the AEF obtaining service API access control policy

Figure 8.12.3-1: Procedure for the AEF obtaining service API access control policy

The AEF sends an obtain access control policy request to the CAPIF core function for obtaining the policy to perform the access control on service API invocations by including the details of the hosted service API.

The CAPIF core function checks whether the AEF is authorized to receive the access control policy corresponding to the service APIs requested.