Content for &nbsp; TS 23.222 &nbsp; Word version:&nbsp; 19.1.0

The API invoker performs service API invocation according to the interface of the service API by sending a service API invocation request towards the AEF which exposes the service API towards the API invoker. The AEF acts as an access control entity.

If the access control policy is not configured with AEF, then the AEF may obtain the access control policy configuration from the CAPIF core function.

Figure 8.18.3-1: Procedure for CAPIF access control with cascaded AEFs

Upon receiving the service API invocation request from the API invoker, the AEF checks for configuration for access control. As per the configuration for access control, the AEF performs access control on the service API invocation request as per the operator policy.

Step 4.

The API invoker receives a service API invocation response for service API invocation from the AEF providing the service API.

8.18 CAPIF access control with cascaded AEFs p. 70

8.18.1 General p. 70

The procedure in this subclause corresponds to the architectural requirements related to some common access control requirements for service API invocations. It provides access control, based on two cascaded API Exposing Function (AEF) instances. While one AEF instance provides the entry point for the service API and acts as access controller, further AEF instances deliver the functionality of the actual service APIs.

8.18.2 Information flows p. 70

8.18.2.1 Service API invocation request p. 70

The information flow service API invocation request from the API invoker to the AEF and between AEFs is service API specific and the complete detail of the service API invocation request is out of scope of the present document. Table 8.17.2.1-1 describes the CAPIF related information elements which are included in the service API invocation request.

8.18.2.2 Service API invocation response p. 70

The information flow service API invocation response from the AEF to the API invoker and between AEFs is service API specific and the complete detail of the service API invocation response is out of scope of the present document. Table 8.17.2.2-1 describes the CAPIF related information elements which are included in the service API invocation response.

8.18.3 Procedure p. 71

Figure 8.18.3-1 illustrates the procedure for CAPIF access control.

Pre-conditions:

The API invoker has performed the service discovery and received the details of the service API which includes the information about the service communication entry point of the AEF-1 in the CAPIF.
The API invoker is authenticated and authorized to use the service API.
The AEF-1 in the CAPIF is configured with at least one access policy to be applied to the service API invocation corresponding to the API invoker and service API.

Reproduction of 3GPP TS 23.222, Fig. 8.18.3-1: Procedure for CAPIF access control with cascaded AEFs

The API invoker performs service API invocation according to the interface of the service API by sending a service API invocation request towards the AEF-1 which exposes the service API towards the API invoker, and acts as access control entity.

Upon receiving the service API invocation request from the API invoker, the AEF-1 checks for configuration for access control. As per the configuration for access control, the AEF-1 performs access control on the service API invocation as per the operator policy.

Table 8.19.2.1-1: API invocation log request

The AEF-1 forwards the incoming service API invocation request to the service API provided by AEF-2.

Step 4.

The AEF-1 receives a service API invocation response for service API invocation from AEF-2.

Step 5.

The AEF-1 resolves the destination API invoker address and modifies the source address information of AEF-2 within the service API invocation response and forwards the service API invocation response to the API invoker.

8.19 Logging service API invocations p. 71

8.19.1 General p. 71

The procedure in this subclause corresponds to the architectural requirements for logging service API invocations at AEF. The AEF can be within PLMN trust domain or within 3rd party trust domain.

8.19.2 Information flows p. 72

8.19.2.1 API invocation log request p. 72

Table 8.19.2.1-1 describes the information flow API invocation log request from the API exposing function to the CAPIF core function.

Information Element	Status	Description
API exposing identity information	M	Identity information of the AEF logging service API(s) invocations
API invocation log information	M	API invocation log information such as API invoker's ID, IP address, service API name, version, invoked operation, input parameters, invocation result, time stamp information, Network Slice Info

8.19.2.2 API invocation log response p. 72

Table 8.19.2.2-1 describes the information flow API invocation log response from the CAPIF core function to the API exposing function.

Table 8.19.2.2-1: API invocation log response

Information Element	Status	Description
Result	M	Indicates the success or failure of API(s) invocation log request

8.19.3 Procedure p. 72

Figure 8.19.3-1 illustrates the procedure for logging service API invocations at AEF.

Pre-conditions:

The API invoker(s) has invoked certain service API(s).
Authorization details of the AEF are available with the CAPIF core function.

Reproduction of 3GPP TS 23.222, Fig. 8.19.3-1: Procedure for logging service API invocations

Figure 8.19.3-1: Procedure for logging service API invocations

Upon invocation of service API(s) from one more API invokers, the AEF triggers API invocation log request towards the CAPIF core function.

The CAPIF core function makes a log entry and stores the information e.g. for charging purposes, for access by authorized users and entities.

Figure 8.20.3-1: Procedure for charging the invocation of service APIs

AEF receives the API invocation log response from the CAPIF core function.

8.20 Charging the invocation of service APIs p. 73

8.20.1 General p. 73

The procedure in this subclause corresponds to the architectural requirements for charging the invocation of service APIs. The AEF can be within PLMN trust domain or within 3rd party trust domain.

8.20.2 Information flows p. 73

8.20.3 Procedure p. 73

Figure 8.20.3-1 illustrates the procedure for charging the invocation of service APIs.

Pre-condition:

Authorization details of the AEF are available with the CAPIF core function.

Reproduction of 3GPP TS 23.222, Fig. 8.20.3-1: Procedure for charging the invocation of service APIs

Upon invocation of service API(s) from one more API invokers, the AEF triggers an API invocation charging request and includes API invoker information (e.g. invoker's ID and IP address, location, timestamp) and service API information (e.g. service API name and version, invoked operation, input parameters, invocation result), Network Slice Info of the service API towards the CAPIF core function.

The CAPIF core function performs a charging procedure which includes storing the information for access by authorized API management.