CAMARA Device Reachability Status Subscriptions 0.8.0 as certified under GSMA Open Gateway. Creates and manages event subscriptions that push CloudEvents notifications to a consumer sink when a device becomes reachable by data or SMS, or becomes disconnected. This is the event-driven half of Open Gateway device status.
openapi: 3.0.3
info:
title: Device Reachability Status Subscriptions
description: |
This API provides the API consumer with the ability to subscribe to Reachability status events.
# Introduction
## Reachability Status
API consumer is able to be notified whether the reachability status of a certain user device has changed to either data- or sms-usage.
This capability is provided via a subscription request - in this case the reachability situation is part of the event notification, which is sent back to the event subscriber when reachability situation has changed.
# Relevant terms and definitions
* **Device**: A device refers to any physical entity that can connect to a network and participate in network communication.
At least one identifier for the device out of four options must be provided: IPv4 address, IPv6 address, Phone number, or Network Access Identifier assigned by the mobile network operator for the device. Where more than one device identifier is provided, only one identifier will be selected by the implementation and this choice indicated to the API consumer in the session creation response.
Note: Network Access Identifier is defined for future use and will not be supported with this version of the API.
# API Functionality
The API exposes following capability:
## Device reachability status subscription
These endpoints allow to manage event subscription on reachability device status event.
The CAMARA subscription model is detailed in the CAMARA API design guideline document and follows CloudEvents specification.
When subscribing, it is mandatory to provide the event `types` you are subscribing to, as multiple subscription-types are managed by this API.
Following event ``types`` are managed for this API:
- ``org.camaraproject.device-reachability-status-subscriptions.v0.reachability-data``: Event triggered when the device is connected to the network for Data usage (regardless of the SMS reachability).
- ``org.camaraproject.device-reachability-status-subscriptions.v0.reachability-sms``: Event triggered when the device is connected to the network only for SMS usage
- ``org.camaraproject.device-reachability-status-subscriptions.v0.reachability-disconnected``: Event triggered when the device is not connected.
Note: Additionally, the following events could be sent, which do not require a dedicated subscription:
- `org.camaraproject.device-reachability-status-subscriptions.v0.subscription-started` is sent when the subscription starts.
- `org.camaraproject.device-reachability-status-subscriptions.v0.subscription-updated` is sent when the subscription is updated.
- `org.camaraproject.device-reachability-status-subscriptions.v0.subscription-ended` is sent when the subscription ends.
It is used in following cases:
- the subscription expire time (optionally set by the requester) has been reached
- the maximum number of subscription events (optionally set by the requester) has been reached
- the subscription was deleted by the requester
- the Access Token `sinkCredential` (optionally set by the requester) expiration time has been reached
- the API server has to stop sending notification prematurely
**Note on combined usage of ``initialEvent`` and ``subscriptionMaxEvents``**:
If an event is triggered following ``initialEvent`` set to true,
this event will be counted towards ``subscriptionMaxEvents`` (if provided).
**Clarification on ``initialEvent`` & ``event-type`` behaviour:**
Following table illustrate behaviour regarding event triggering depending on **initial** reachability state of the device:
| subscribed event-type | device reachability status at subscription time | event sent if ``initialEvent`` set to true | Explanation |
| ----------------------| ------------- | --------------- | ---------------|
| reachability-data | Device can use data | Yes | The device is reachable for data, so the event is triggered. |
| reachability-data | Device is disconnected or SMS-only | No | The device cannot use data, so no event is sent. |
| reachability-sms | Device can use data | No | The device can use data, but for thids event is only for SMS. |
| reachability-sms | Device is SMS-only | Yes | The device supports SMS, so the event is triggered. |
| reachability-sms | Device is disconnected | No | The device cannot send SMS, so no event is send. |
| reachability-disconnected | Device can use data or SMS usage | No | The device is reachable, so no "disconnected" event is sent. |
| reachability-disconnected | Device is disconnected | Yes | The device is disconnected, so the event is triggered. |
### Notifications callback
This endpoint describes the event notification received on subscription listener side when the event occurred.
As for subscription, detailed description of the event notification is provided in the CAMARA API design guideline document.
_**WARNING**: This callback endpoint must be exposed on the consumer side as `POST /{$request.body#/sink}`.
Developers may provide a callback URL on which notifications regarding reachability-status can be received from the service provider.
If an event occurs the application will send events to the provided webhook - `sink`._
# Further info and support
## Authorization and authentication
The "Camara Security and Interoperability Profile" provides details of how an API consumer requests an access token. Please refer to Identity and Consent Management (https://github.com/camaraproject/IdentityAndConsentManagement/) for the released version of the profile.
The specific authorization flows to be used will be agreed upon during the onboarding process, happening between the API consumer and the API provider, taking into account the declared purpose for accessing the API, whilst also being subject to the prevailing legal framework dictated by local legislation.
In cases where personal data is processed by the API and users can exercise their rights through mechanisms such as opt-in and/or opt-out, the use of three-legged access tokens is mandatory. This ensures that the API remains in compliance with privacy regulations, upholding the principles of transparency and user-centric privacy-by-design.
## Identifying the device from the access token
This API requires the API consumer to identify a device as the subject of the API as follows:
- When the API is invoked using a two-legged access token, the subject will be identified from the optional `device` object, which therefore MUST be provided.
- When a three-legged access token is used however, this optional identifier MUST NOT be provided, as the subject will be uniquely identified from the access token.
This approach simplifies API usage for API consumers using a three-legged access token to invoke the API by relying on the information that is associated with the access token and was identified during the authentication process.
### Error handling:
- If the subject cannot be identified from the access token and the optional `device` object is not included in the request, then the server will return an error with the `422 MISSING_IDENTIFIER` error code.
- If the subject can be identified from the access token and the optional `device` object is also included in the request, then the server will return an error with the `422 UNNECESSARY_IDENTIFIER` error code. This will be the case even if the same device is identified by these two methods, as the server is unable to make this comparison.
## Multi-SIM scenario handling
In multi-SIM scenarios where more than one mobile device is associated with a phone number (e.g. a smartphone with an associated smartwatch), it might not be possible to uniquely identify from that phone number the device for which reachability status notifications should be provided. If the phone number is used as the device identifier when creating a subscription for a multi-SIM scenario, the API may:
- respond with an error, or
- provide reachability status update notifications for the multi-SIM group as a whole, or
- provide reachability status update notifications only for a single device in the multi-SIM group, which may not be the intended device.
Possible solutions in such a scenario include:
- Using the authorisation code flow to obtain an access token, which will automatically identify the intended device
- Identifying the intended device from a unique identifier for that device, such as its source IP address and port
- Check with the SIM provider whether a unique "secondary" phone number is already associated with each device, and use the secondary phone number to identify the intended device if available.
## Additional CAMARA error responses
The list of error codes in this API specification is not exhaustive. Therefore the API specification may not document some non-mandatory error statuses as indicated in `CAMARA API Design Guide`.
Please refer to the `CAMARA_common.yaml` of the Commonalities Release associated to this API version for a complete list of error responses. The applicable Commonalities Release can be identified in the `API Readiness Checklist` document associated to this API version.
As a specific rule, error `501 - NOT_IMPLEMENTED` can be only a possible error response if it is explicitly documented in the API.
license:
name: Apache 2.0
url: https://www.apache.org/licenses/LICENSE-2.0.html
version: 0.8.0
x-camara-commonalities: 0.6
externalDocs:
description: Product documentation at CAMARA
url: https://github.com/camaraproject/DeviceReachabilityStatus
servers:
- url: "{apiRoot}/device-reachability-status-subscriptions/v0.8"
variables:
apiRoot:
default: http://localhost:9091
description: API root, defined by the service provider, e.g. api.example.com or api.example.com/somepath
tags:
- name: Device reachability status subscription
description: Operation to manage event subscription on device reachability status event.
paths:
/subscriptions:
post:
tags:
- Device reachability status subscription
summary: "Create a device reachability status event subscription for a device"
description: Create a device reachability status event subscription for a device
operationId: createDeviceReachabilityStatusSubscription
parameters:
- $ref: '#/components/parameters/x-correlator'
security:
- openId:
- device-reachability-status-subscriptions:org.camaraproject.device-reachability-status-subscriptions.v0.reachability-data:create
- device-reachability-status-subscriptions:org.camaraproject.device-reachability-status-subscriptions.v0.reachability-sms:create
- device-reachability-status-subscriptions:org.camaraproject.device-reachability-status-subscriptions.v0.reachability-disconnected:create
requestBody:
required: true
content:
application/json:
schema:
$ref: "#/components/schemas/SubscriptionRequest"
examples:
Create Subscription:
$ref: "#/components/examples/CREATE_SUBSCRIPTION"
callbacks:
notifications:
"{$request.body#/sink}":
post:
summary: "notifications callback"
description: |
Important: this endpoint is to be implemented by the API consumer.
The Device status server will call this endpoint whenever any device reachability status related event occurs.
operationId: postNotification
parameters:
- $ref: '#/components/parameters/x-correlator'
requestBody:
required: true
content:
application/cloudevents+json:
schema:
$ref: "#/components/schemas/CloudEvent"
examples:
reachability-data:
$ref: "#/components/examples/REACHABILITY_DATA"
reachability-sms:
$ref: "#/components/examples/REACHABILITY_SMS"
reachability-disconnected:
$ref: "#/components/examples/REACHABILITY_DISCONNECTED"
subscription-started:
$ref: "#/components/examples/SUBSCRIPTION_STARTED"
subscription-updated:
$ref: "#/components/examples/SUBSCRIPTION_UPDATED"
subscription-ended:
$ref: "#/components/examples/SUBSCRIPTION_ENDED"
responses:
"204":
description: Successful notification
headers:
x-correlator:
$ref: '#/components/headers/x-correlator'
"400":
$ref: "#/components/responses/Generic400"
"401":
$ref: "#/components/responses/Generic401"
"403":
$ref: "#/components/responses/Generic403"
"410":
$ref: "#/components/responses/Generic410"
"429":
$ref: "#/components/responses/Generic429"
security:
- {}
- notificationsBearerAuth: []
responses:
"201":
description: Created
headers:
x-correlator:
$ref: "#/components/headers/x-correlator"
content:
application/json:
schema:
$ref: "#/components/schemas/Subscription"
examples:
Active Subscription:
$ref: "#/components/examples/ACTIVE_SUBSCRIPTION"
Active Subscription With Device Disambiguation:
$ref: "#/components/examples/ACTIVE_SUBSCRIPTION_WITH_DEVICE_DISAMBIGUATION"
"202":
description: Request accepted to be processed. It applies for async creation process.
headers:
x-correlator:
$ref: "#/components/headers/x-correlator"
content:
application/json:
schema:
$ref: "#/components/schemas/SubscriptionAsync"
"400":
$ref: "#/components/responses/CreateSubscriptionBadRequest400"
"401":
$ref: "#/components/responses/Generic401"
"403":
$ref: "#/components/responses/SubscriptionPermissionDenied403"
"409":
$ref: "#/components/responses/Generic409"
"422":
$ref: "#/components/responses/CreateSubscriptionUnprocessableEntity422"
"429":
$ref: "#/components/responses/Generic429"
get:
tags:
- Device reachability status subscription
summary: "Retrieve a list of device reachability status event subscription"
description: Retrieve a list of device reachability status event subscription(s)
operationId: retrieveDeviceReachabilityStatusSubscriptionList
parameters:
- $ref: "#/components/parameters/x-correlator"
security:
- openId:
- device-reachability-status-subscriptions:read
responses:
"200":
description: List of event subscription details
headers:
x-correlator:
$ref: "#/components/headers/x-correlator"
content:
application/json:
schema:
type: array
minItems: 0
items:
$ref: "#/components/schemas/Subscription"
examples:
List of Subscriptions:
$ref: "#/components/examples/SUBSCRIPTION_LIST"
Empty List of Subscriptions:
$ref: "#/components/examples/EMPTY_SUBSCRIPTION_LIST"
"400":
$ref: "#/components/responses/Generic400"
"401":
$ref: "#/components/responses/Generic401"
"403":
$ref: "#/components/responses/Generic403"
/subscriptions/{subscriptionId}:
get:
tags:
- Device reachability status subscription
summary: "Retrieve a device reachability status event subscription for a device"
operationId: retrieveDeviceReachabilityStatusSubscription
description: Retrieve a given subscription by ID
security:
- openId:
- device-reachability-status-subscriptions:read
parameters:
- $ref: "#/components/parameters/SubscriptionId"
- $ref: '#/components/parameters/x-correlator'
responses:
"200":
description: OK
headers:
x-correlator:
$ref: '#/components/headers/x-correlator'
content:
application/json:
schema:
$ref: "#/components/schemas/Subscription"
examples:
Active Subscription:
$ref: "#/components/examples/ACTIVE_SUBSCRIPTION"
Active Subscription With Device Disambiguation:
$ref: "#/components/examples/ACTIVE_SUBSCRIPTION_WITH_DEVICE_DISAMBIGUATION"
Subscription Activation Requested:
$ref: "#/components/examples/SUBSCRIPTION_ACTIVATION_REQUESTED"
Subscription Deleted:
$ref: "#/components/examples/SUBSCRIPTION_DELETED"
"400":
$ref: "#/components/responses/SubscriptionIdRequired400"
"401":
$ref: "#/components/responses/Generic401"
"403":
$ref: "#/components/responses/Generic403"
"404":
$ref: "#/components/responses/Generic404"
delete:
tags:
- Device reachability status subscription
summary: "Delete a device reachability status event subscription for a device"
operationId: deleteDeviceReachabilityStatusSubscription
description: Delete a given subscription by ID
security:
- openId:
- device-reachability-status-subscriptions:delete
parameters:
- $ref: "#/components/parameters/SubscriptionId"
- $ref: '#/components/parameters/x-correlator'
responses:
"204":
description: event subscription deleted
headers:
x-correlator:
$ref: '#/components/headers/x-correlator'
"202":
description: Request accepted to be processed. It applies for async deletion process.
headers:
x-correlator:
$ref: '#/components/headers/x-correlator'
content:
application/json:
schema:
$ref: "#/components/schemas/SubscriptionAsync"
"400":
$ref: "#/components/responses/SubscriptionIdRequired400"
"401":
$ref: "#/components/responses/Generic401"
"403":
$ref: "#/components/responses/Generic403"
"404":
$ref: "#/components/responses/Generic404"
components:
securitySchemes:
openId:
type: openIdConnect
openIdConnectUrl: https://example.com/.well-known/openid-configuration
notificationsBearerAuth:
type: http
scheme: bearer
bearerFormat: "{$request.body#/sinkCredential.credentialType}"
parameters:
SubscriptionId:
name: subscriptionId
in: path
description: Subscription identifier that was obtained from the create event subscription operation
required: true
schema:
$ref: "#/components/schemas/SubscriptionId"
x-correlator:
name: x-correlator
in: header
description: Correlation id for the different services
schema:
$ref: "#/components/schemas/XCorrelator"
headers:
x-correlator:
description: Correlation id for the different services
schema:
$ref: "#/components/schemas/XCorrelator"
schemas:
ErrorInfo:
type: object
required:
- status
- code
- message
properties:
status:
type: integer
description: HTTP response status code
code:
type: string
description: A human-readable code to describe the error
message:
type: string
description: A human-readable description of what the event represents
SubscriptionRequest:
description: The request for creating a event-type event subscription
type: object
required:
- sink
- protocol
- config
- types
properties:
protocol:
$ref: "#/components/schemas/Protocol"
sink:
type: string
format: uri
pattern: ^https:\/\/.+$
description: The address to which events shall be delivered using the selected protocol.
example: "https://endpoint.example.com/sink"
sinkCredential:
$ref: "#/components/schemas/SinkCredential"
types:
description: |
Camara Event types eligible to be delivered by this subscription.
Note: For the current Commonalities API design guidelines, only one event type per subscription is allowed, yet in the following releases use of array of event types SHALL be specified without changing this definition.
type: array
minItems: 1
maxItems: 1
items:
$ref: "#/components/schemas/SubscriptionEventType"
config:
$ref: "#/components/schemas/Config"
discriminator:
propertyName: protocol
mapping:
HTTP: "#/components/schemas/HTTPSubscriptionRequest"
MQTT3: "#/components/schemas/MQTTSubscriptionRequest"
MQTT5: "#/components/schemas/MQTTSubscriptionRequest"
AMQP: "#/components/schemas/AMQPSubscriptionRequest"
NATS: "#/components/schemas/NATSSubscriptionRequest"
KAFKA: "#/components/schemas/ApacheKafkaSubscriptionRequest"
Protocol:
type: string
enum: ["HTTP", "MQTT3", "MQTT5", "AMQP", "NATS", "KAFKA"]
description: Identifier of a delivery protocol. Only HTTP is allowed for now
example: "HTTP"
Config:
description: |
Implementation-specific configuration parameters needed by the subscription manager for acquiring events.
In CAMARA we have predefined attributes like `subscriptionExpireTime`, `subscriptionMaxEvents`, `initialEvent`
Specific event type attributes must be defined in `subscriptionDetail`
Note: if a request is performed for several event type, all subscribed event will use same `config` parameters.
type: object
required:
- subscriptionDetail
properties:
subscriptionDetail:
$ref: "#/components/schemas/CreateSubscriptionDetail"
subscriptionExpireTime:
type: string
format: date-time
example: 2023-01-17T13:18:23.682Z
description: The subscription expiration time (in date-time format) requested by the API consumer.
subscriptionMaxEvents:
type: integer
description: Identifies the maximum number of event reports to be generated (>=1) requested by the API consumer - Once this number is reached, the subscription ends.
minimum: 1
example: 5
initialEvent:
type: boolean
description: |
Set to `true` by API consumer if consumer wants to get an event as soon as the subscription is created and current situation reflects event request.
Example: Consumer subscribes to reachability SMS. If consumer sets initialEvent to true and device is already reachable by SMS, an event is triggered.
SinkCredential:
description: A sink credential provides authentication or authorization information necessary to enable delivery of events to a target.
type: object
properties:
credentialType:
type: string
enum:
- PLAIN
- ACCESSTOKEN
- REFRESHTOKEN
description: |
The type of the credential.
Note: Type of the credential - MUST be set to ACCESSTOKEN for now
discriminator:
propertyName: credentialType
mapping:
PLAIN: "#/components/schemas/PlainCredential"
ACCESSTOKEN: "#/components/schemas/AccessTokenCredential"
REFRESHTOKEN: "#/components/schemas/RefreshTokenCredential"
required:
- credentialType
PlainCredential:
type: object
description: A plain credential as a combination of an identifier and a secret.
allOf:
- $ref: "#/components/schemas/SinkCredential"
- type: object
required:
- identifier
- secret
properties:
identifier:
description: The identifier might be an account or username.
type: string
secret:
description: The secret might be a password or passphrase.
type: string
AccessTokenCredential:
type: object
description: An access token credential.
allOf:
- $ref: "#/components/schemas/SinkCredential"
- type: object
properties:
accessToken:
description: REQUIRED. An access token is a previously acquired token granting access to the target resource.
type: string
accessTokenExpiresUtc:
type: string
format: date-time
description: |
REQUIRED. An absolute (UTC) timestamp at which the token shall be considered expired.
In the case of an ACCESS_TOKEN_EXPIRED termination reason, implementation should notify the client before the expiration date.
If the access token is a JWT and registered "exp" (Expiration Time) claim is present, the two expiry times should match.
It must follow [RFC 3339](https://datatracker.ietf.org/doc/html/rfc3339#section-5.6) and must have time zone.
Recommended format is yyyy-MM-dd'T'HH:mm:ss.SSSZ (i.e. which allows 2023-07-03T14:27:08.312+02:00 or 2023-07-03T12:27:08.312Z)
example: "2023-07-03T12:27:08.312Z"
accessTokenType:
description: REQUIRED. Type of the access token (See [OAuth 2.0](https://tools.ietf.org/html/rfc6749#section-7.1)).
type: string
enum:
- bearer
required:
- accessToken
- accessTokenExpiresUtc
- accessTokenType
RefreshTokenCredential:
type: object
description: An access token credential with a refresh token.
allOf:
- $ref: "#/components/schemas/SinkCredential"
- type: object
properties:
accessToken:
description: REQUIRED. An access token is a previously acquired token granting access to the target resource.
type: string
accessTokenExpiresUtc:
type: string
format: date-time
description: |
REQUIRED. An absolute (UTC) timestamp at which the token shall be considered expired.
In the case of an ACCESS_TOKEN_EXPIRED termination reason, implementation should notify the client before the expiration date.
If the access token is a JWT and registered "exp" (Expiration Time) claim is present, the two expiry times should match.
It must follow [RFC 3339](https://datatracker.ietf.org/doc/html/rfc3339#section-5.6) and must have time zone.
Recommended format is yyyy-MM-dd'T'HH:mm:ss.SSSZ (i.e. which allows 2023-07-03T14:27:08.312+02:00 or 2023-07-03T12:27:08.312Z)
example: "2023-07-03T12:27:08.312Z"
accessTokenType:
description: REQUIRED. Type of the access token (See [OAuth 2.0](https://tools.ietf.org/html/rfc6749#section-7.1)).
type: string
enum:
- bearer
refreshToken:
description: REQUIRED. An refresh token credential used to acquire access tokens.
type: string
refreshTokenEndpoint:
type: string
format: uri
description: REQUIRED. A URL at which the refresh token can be traded for an access token.
required:
- accessToken
- accessTokenExpiresUtc
- accessTokenType
- refreshToken
- refreshTokenEndpoint
CreateSubscriptionDetail:
description: The detail of the requested event subscription.
type: object
properties:
device:
$ref: "#/components/schemas/Device"
EventTypeNotification:
type: string
description: |
reachability-data - Event triggered when the device is connected to the network for Data usage (regardless of the SMS reachability).
reachability-sms - Event triggered when the device is connected to the network only for SMS usage.
reachability-disconnected - Event triggered when the device is not connected.
subscription-started - Event triggered when the subscription starts.
subscription-updated - Event triggered when the subscription is updated.
subscription-ended - Event triggered when the subscription ends.
enum:
- org.camaraproject.device-reachability-status-subscriptions.v0.reachability-data
- org.camaraproject.device-reachability-status-subscriptions.v0.reachability-sms
- org.camaraproject.device-reachability-status-subscriptions.v0.reachability-disconnected
- org.camaraproject.device-reachability-status-subscriptions.v0.subscription-started
- org.camaraproject.device-reachability-status-subscriptions.v0.subscription-updated
- org.camaraproject.device-reachability-status-subscriptions.v0.subscription-ended
SubscriptionEventType:
type: string
description: |
reachability-data - Event triggered when the device is connected to the network for Data usage (regardless of the SMS reachability).
reachability-sms - Event triggered when the device is connected to the network only for SMS usage
reachability-disconnected - Event triggered when the device is not connected.
enum:
- org.camaraproject.device-reachability-status-subscriptions.v0.reachability-data
- org.camaraproject.device-reachability-status-subscriptions.v0.reachability-sms
- org.camaraproject.device-reachability-status-subscriptions.v0.reachability-disconnected
Subscription:
description: Represents a event-type subscription.
type: object
required:
- sink
- protocol
- config
- types
- id
properties:
protocol:
$ref: "#/components/schemas/Protocol"
sink:
type: string
format: uri
pattern: ^https:\/\/.+$
description: The address to which events shall be delivered using the selected protocol.
example: "https://endpoint.example.com/sink"
types:
description: |
Camara Event types eligible to be delivered by this subscription.
Note: For the current Commonalities API design guidelines, only one event type per subscription is allowed
type: array
minItems: 1
maxItems: 1
items:
$ref: "#/components/schemas/SubscriptionEventType"
config:
$ref: '#/components/schemas/Config'
id:
$ref: '#/components/schemas/SubscriptionId'
startsAt:
type: string
format: date-time
description: |
Date when the event subscription will begin/began
It must follow [RFC 3339](https://datatracker.ietf.org/doc/html/rfc3339#section-5.6) and must have time zone.
Recommended format is yyyy-MM-dd'T'HH:mm:ss.SSSZ (i.e. which allows 2023-07-03T14:27:08.312+02:00 or 2023-07-03T12:27:08.312Z)
example: "2023-07-03T12:27:08.312Z"
expiresAt:
type: string
format: date-time
description: |
Date when the event subscription will expire. Only provided when `subscriptionExpireTime` is indicated by API client or Telco Operator has specific policy about that.
It must follow [RFC 3339](h
# --- truncated at 32 KB (72 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/open-gateway/refs/heads/main/openapi/camara-device-reachability-status-subscriptions-openapi.yml