The procedure in this subclause corresponds to the architectural requirements for API invoker authorization to access service APIs.
A secure communication channel is mandatory in CAPIF.
To reduce latency during API invocation, the API invoker associated authorization information can be made available at the AEF after authentication between the API invoker and the CAPIF core function.
The security related aspects related to this procedure are out of scope of the present document.
220.127.116.11 Service API invocation request
The information flow service API invocation request from the API invoker to the AEF is service API specific and the complete detail of the service API invocation request is out of scope of the present document. Table 18.104.22.168-1 describes only the CAPIF related information elements which are included in the service API invocation request.
22.214.171.124 Service API invocation response
API invoker identity information
The information that determines the identity of the API invoker
O (see NOTE)
The authorization information obtained before initiating the service API invocation request
Service API identification
The identification information of the service API for which invocation is requested. The service API identification is part of the specific service API invocation request.
The inclusion of this information element depends on the chosen solution for authorization.
The information flow service API invocation response from the AEF to the API invoker is service API specific and the complete detail of the service API invocation response is out of scope of the present document. Table 126.96.36.199-1 describes only the CAPIF related information elements which are included in the service API invocation response.
Indicates the success or failure of service API invocation.
Figure 8.16.3-1 illustrates the procedure for API invoker authorization to access service APIs.
The API invoker has been authenticated.
The API invoker associated authorization information is available at AEF.
The API invoker triggers service API invocation request to the AEF, including the service API to be invoked.
Authentication can also be performed if not authenticated previously.
The API invoker can trigger several service API invocations asynchronously.
Upon receiving the service API invocation request, the AEF checks whether the API invoker is authorized to invoke that service API, based on the authorization information.
If the AEF does not have information required to authorize service API invocation, the AEF obtains the authorization information from the CAPIF core function.
The AEF executes the service logic for the invoked service API.
The API invoker receives the service API invocation response as a result of the service API invocation.