Content for  TS 23.222  Word version:  19.7.0

An API invoker sends obtain service API authorization request to the CAPIF core function for obtaining permission to access a service API by including its API invoker identity information and any information required for authentication of the API invoker. The API invoker includes in the request information about the purpose and the targeted resources and operations to be performed on those resources.

The CCF performs the authentication of the API invoker (using authentication information) and checks whether it is permitted to access the requested service API by checking whether a resource owner authorization information is already available for that API invoker. If the authorization for accessing the requested resources for the signalled purpose is already granted, the procedure continues with step 4.

If authorization information is not available regarding whether the API invoker is permitted to access the requested service API (i.e., there is no applicable resource owner authorization information available) the collective resource owner authorization configuration (Table 8.33.3-1) is assessed. If authorization trigger criteria have been specified as part of the collective resource owner authorization configuration, interactions with the resource owner are only initiated once the trigger conditions are met. If trigger criteria have not been set or once the trigger conditions are met, the authorization function determines the authorization by interacting with the resource owner via the ROF deployed on a UE. Based on the configured collective resource owner authorization configuration at the CCF and any cached "obtain service API authorization requests", the scope of the request towards the ROF can be expanded to include additional API invokers and or service APIs based on the assumption that there is an association between the requesting API invoker and the API exposing functions and API invokers listed in the CCF configuration.

Based on the RO authorization information obtained via the ROF for each API invoker and corresponding service API(s), the CCF sends an API invoker specific service API authorization response (as described in clause 8.31) to the API invoker that initially triggered the collective resource owner authorization information requested and to each API invoker for which a obtain service API authorization request was received (for the same service API) whilst the collective resource owner authorization configuration duration timer was running, i.e., the cached requests.

An API invoker that receives the service API authorization response can send service API invocation requests to the API exposing function with their API invoker specific resource owner authorization information as described in clause 8.31.

The API exposing function will send a service API invocation response once it has successfully checked that the API invoker is authorized to invoke that service API based on the authorization information.

The API invoker (e.g., in UE 2) sends an Obtain service API authorization request to the CCF for obtaining permission to access the service API for other UE's resources hosted in the network (e.g., location) by including the API invoker identity information and any information required for authentication of the API invoker. The request includes API invoker information, the group identifier, and the UE in a group whose resources are to be accessed, and the identity of UE2. Additionally, the API invoker may include in the request information about the purpose and operations (scope) to be performed on the targeted resources.

CCF performs authentication of the API invoker (using authentication information) as specified in TS 33.122.

The CCF, based on the group identifier determines that RO authorization is provided by a GRO. The CCF then resolves the identity of the GRO responsible for the group of UEs based on the provisioned group context information related to the GRO, as specified in Annex E. The CCF shall additionally check whether UE2 belongs to the group.

If step 3 is successful, the CCF performs the resource owner authorization check using the GRO as the RO for the requested resources of other UE(s) belonging to the group.

Based on the group resource owner authorization received in step 4, the CCF sends an Obtain service API authorization response to the API invoker. The authorization response indicates that the access to UE (resource owner) network resource(s) is authorized for an indicated scope.

The API invoker sends service API invocation request to the API exposing function with the RO authorization information received in step 5.

The API invoker receives the service API invocation response resulting from the service API invocation once the API exposing function has checked whether the API invoker is authorized to invoke that service API based on the RO authorization information.

The RO triggers the revocation of the resource authorization via ROF.

The ROF requests resource authorization revocation to the CAPIF core function.

The CAPIF core function determines the revoked authorization information for the API Invoker and Service API as specified in clause 6.5.3.4 of TS 33.122.

The CAPIF core function sends a revoke resource authorization notification to the API invoker according to the procedure in clause 8.23.4.

The CAPIF core function sends a revoke resource authorization notification to the API exposing function according to the procedure in clause 8.23.4.