Content for &nbsp; TS 23.222 &nbsp; Word version:&nbsp; 19.7.0

The API invoker performs service API invocation according to the interface of the service API by sending a service API invocation request towards the AEF-1 which exposes the service API towards the API invoker, and acts as topology hiding entity.

The AEF-1 further resolves the actual destination service API address information according to the topology hiding policy and forwards the incoming service API invocation request to the service API of the related AEF-2.

The AEF-1 receives a response request for service API invocation from service API provided by AEF-2.

Figure 8.14.3-1: Procedure for authentication between the API invoker and the AEF prior to service API invocation

The AEF-1 resolves the destination API invoker address and also modifies the source address information of the AEF-2 within the response request as per topology hiding policy and forwards the response request to the API invoker.

8.14 Authentication between the API invoker and the AEF prior to service API invocation p. 67

8.14.1 General p. 67

The procedure in this subclause corresponds to the architectural requirements for authentication of the API invoker by the AEF.

To reduce latency during API invocation, the API invoker associated authentication information can be made available at the AEF after authentication between the API invoker and the CAPIF core function.

8.14.2 Information flows p. 67

8.14.3 Procedure p. 67

Figure 8.14.3-1 illustrates the procedure for authentication between the API invoker and the AEF.

Pre-condition:

Optionally, the CAPIF core function has shared the information required for authentication of the API invoker with the AEF.

Reproduction of 3GPP TS 23.222, Fig. 8.14.3-1: Procedure for authentication between the API invoker and the AEF prior to service API invocation

The API invoker triggers authentication initiation to the AEF, including the API invoker identity.

The AEF obtains the API invoker information required for authentication by the AEF, if not available.

The AEF returns the result of authentication initiation in the authentication initiation response.

Table 8.15.2.1-1: Service API invocation request with authentication information

The AEF verifies the identity of the API invoker and authenticates the API invoker.

8.15 Authentication between the API invoker and the AEF upon the service API invocation p. 68

8.15.1 General p. 68

The procedure in this subclause corresponds to the architectural requirements for authentication of the API invoker by the AEF upon the service API invocation.

8.15.2 Information flows p. 68

8.15.2.1 Service API invocation request with authentication information p. 68

The information flow service API invocation request with authentication information from the API invoker to the AEF is service API specific and the complete detail of the service API invocation request is out of scope of the present document. Table 8.15.2.1-1 describes only the CAPIF related information elements which are included in the service API invocation request.

Information element	Status	Description
API invoker identity information	M	The information that determines the identity of the API invoker
Authentication information	M (see NOTE)	The authentication information obtained before initiating the service API invocation request
Service API identification	M	The identification information of the service API for which invocation is requested. The service API identification is part of the specific service API invocation request.
NOTE: The specific security information of this information element is specified in subclause 6.5.2 of TS 33.122.

8.15.2.2 Service API invocation response p. 68

The information flow service API invocation response from the AEF to the API invoker is service API specific and the complete detail of the service API invocation response is out of scope of the present document. Table 8.15.2.2-1 describes only the CAPIF related information elements which are included in the service API invocation response.

Table 8.15.2.2-1: Service API invocation response

Information element	Status	Description
Result	M	Indicates the success or failure of service API invocation.
Cause	O	The cause for the request failure.

8.15.3 Procedure p. 68

Figure 8.15.3-1 illustrates the procedure for authentication of the API invoker by the AEF, where the authentication information is carried in the API invocation request.

Pre-condition:

Optionally, the CAPIF core function has shared the information required for authentication of the API invoker with the AEF.

Reproduction of 3GPP TS 23.222, Fig. 8.15.3-1: Procedure for authentication between the API invoker and the AEF upon the service API invocation

Figure 8.15.3-1: Procedure for authentication between the API invoker and the AEF upon the service API invocation

The API invoker invokes a service API invocation request with authentication information to the AEF, and includes in this request authentication information, including the API invoker identity.

The AEF obtains the API invoker information required for authentication by the AEF, if not available.

The AEF verifies the identity of the API invoker and authenticates the API invoker.

Table 8.16.2.1-1: Service API invocation request

If the verification was successful, the AEF returns the result of the service API invocation in the Service API invocation response.

8.16 Service API invocation with AEF authorization p. 69

8.16.1 General p. 69

The procedure in this subclause corresponds to the architectural requirements to validate authorization of API invokers upon the service API invocation.

To reduce latency during API invocation, the API invoker associated authorization information can be made available at the AEF after authentication between the API invoker and the CAPIF core function.

8.16.2 Information flows p. 70

8.16.2.1 Service API invocation request p. 70

The information flow service API invocation request from the API invoker to the AEF is service API specific and the complete detail of the service API invocation request is out of scope of the present document. Table 8.16.2.1-1 describes only the CAPIF related information elements which are included in the service API invocation request.

Information element	Status	Description
API invoker identity information	M	The information that determines the identity of the API invoker
Authorization information	O (see NOTE)	The authorization information obtained before initiating the service API invocation request
Network Slice Info	O (see NOTE)	The desired network slice information of the service API
Service API identification	M	The identification information of the service API for which invocation is requested. The service API identification is part of the specific service API invocation request.
NOTE: The inclusion of this information element depends on the chosen solution for authorization.

8.16.2.2 Service API invocation response p. 70

The information flow service API invocation response from the AEF to the API invoker is service API specific and the complete detail of the service API invocation response is out of scope of the present document. Table 8.16.2.2-1 describes only the CAPIF related information elements which are included in the service API invocation response.

Table 8.16.2.2-1: Service API invocation response

Information element	Status	Description
Result	M	Indicates the success or failure of service API invocation.
Authorization information with resource owner required	O	This information element may be present when the result is failure. Indicates that the required authorization information with resource owner is required.

8.16.3 Procedure p. 70

Figure 8.16.3-1 illustrates the procedure for API invoker authorization to access service APIs.

Pre-conditions:

The API invoker has been authenticated.
The API invoker associated authorization information is available at AEF.

Reproduction of 3GPP TS 23.222, Fig. 8.16.3-1: Procedure for API invoker authorization to access service APIs

Figure 8.16.3-1: Procedure for API invoker authorization to access service APIs

The API invoker triggers service API invocation request to the AEF, including the service API to be invoked.

Upon receiving the service API invocation request, the AEF checks whether the API invoker is authorized to invoke that service API, based on the authorization information.

Step 2a.

If the AEF does not have information required to authorize service API invocation, the AEF obtains the authorization information from the CAPIF core function.

The AEF executes the service logic for the invoked service API.