openapi: 3.0.0
info:
  version: '1.1.0'
  title: 'NudmUEAU'
  description: |
    UDM UE Authentication Service.
    © 2020, 3GPP Organizational Partners (ARIB, ATIS, CCSA, ETSI, TSDSI, TTA, TTC).
    All rights reserved.

externalDocs:
  description: 3GPP TS 29.503 Unified Data Management Services, version 16.4.0
  url: 'http://www.3gpp.org/ftp/Specs/archive/29_series/29.503/'

servers:
  - url: '{apiRoot}/nudm-ueau/v1'
    variables:
      apiRoot:
        default: https://example.com
        description: apiRoot as defined in clause clause 4.4 of 3GPP TS 29.501.

security:
  - oAuth2ClientCredentials:
    - nudm-ueau
  - {}

paths:
  /{supiOrSuci}/security-information/generate-auth-data:
    post:
      summary: Generate authentication data for the UE
      operationId: GenerateAuthData
      tags:
        - Generate Auth Data
      parameters:
        - name: supiOrSuci
          in: path
          description: SUPI or SUCI of the user
          required: true
          schema:
            $ref: 'TS29571_CommonData.yaml#/components/schemas/SupiOrSuci'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AuthenticationInfoRequest'
        required: true
      responses:
        '200':
          description: Expected response to a valid request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AuthenticationInfoResult'
        '400':
          $ref: 'TS29571_CommonData.yaml#/components/responses/400'
        '403':
          $ref: 'TS29571_CommonData.yaml#/components/responses/403'
        '404':
          $ref: 'TS29571_CommonData.yaml#/components/responses/404'
        '500':
          $ref: 'TS29571_CommonData.yaml#/components/responses/500'
        '501':
          $ref: 'TS29571_CommonData.yaml#/components/responses/501'
        '503':
          $ref: 'TS29571_CommonData.yaml#/components/responses/503'
        default:
          description: Unexpected error

  /{supiOrSuci}/security-information-rg:
    get:
      summary: Get authentication data for the FN-RG
      operationId: GetRgAuthData
      tags:
        - Get Auth Data for FN-RG
      parameters:
        - name: supiOrSuci
          in: path
          description: SUPI or SUCI of the user
          required: true
          schema:
            $ref: 'TS29571_CommonData.yaml#/components/schemas/SupiOrSuci'
        - name: authenticated-ind
          in: query
          description: Authenticated indication
          required: true
          schema:
             $ref: '#/components/schemas/AuthenticatedInd'
        - name: supported-features
          in: query
          description: Supported Features
          schema:
             $ref: 'TS29571_CommonData.yaml#/components/schemas/SupportedFeatures'
        - name: plmn-id
          in: query
          description: serving PLMN ID
          content:
            application/json:
              schema:
                $ref: 'TS29571_CommonData.yaml#/components/schemas/PlmnId'
        - name: If-None-Match
          in: header
          description: Validator for conditional requests, as described in RFC 7232, 3.2
          schema:
            type: string
        - name: If-Modified-Since
          in: header
          description: Validator for conditional requests, as described in RFC 7232, 3.3
          schema:
            type: string
      responses:
        '200':
          description: Expected response to a valid request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RgAuthCtx'
        '400':
          $ref: 'TS29571_CommonData.yaml#/components/responses/400'
        '403':
          $ref: 'TS29571_CommonData.yaml#/components/responses/403'
        '404':
          $ref: 'TS29571_CommonData.yaml#/components/responses/404'
        '500':
          $ref: 'TS29571_CommonData.yaml#/components/responses/500'
        '503':
          $ref: 'TS29571_CommonData.yaml#/components/responses/503'
        default:
          description: Unexpected error

  /{supi}/auth-events:
    post:
      summary: Create a new confirmation event
      operationId: ConfirmAuth
      tags:
        - Confirm Auth
      parameters:
        - name: supi
          in: path
          description: SUPI of the user
          required: true
          schema:
            $ref: 'TS29571_CommonData.yaml#/components/schemas/Supi'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AuthEvent'
        required: true
      responses:
        '201':
          description: Expected response to a valid request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AuthEvent'
          headers:
            Location:
              description: 'Contains the URI of the newly created resource, according to the structure: {apiRoot}/nudm-ueau/v1/{supi}/auth-events/{authEventId}'
              required: true
              schema:
                type: string
        '400':
          $ref: 'TS29571_CommonData.yaml#/components/responses/400'
        '404':
          $ref: 'TS29571_CommonData.yaml#/components/responses/404'
        '500':
          $ref: 'TS29571_CommonData.yaml#/components/responses/500'
        '503':
          $ref: 'TS29571_CommonData.yaml#/components/responses/503'
        default:
          description: Unexpected error

  /{supi}/hss-security-information/{hssAuthType}/generate-av:
    post:
      summary: Generate authentication data for the UE in EPS or IMS domain
      operationId: GenerateAv
      tags:
        - Generate HSS Authentication Vectors
      parameters:
        - name: supi
          in: path
          description: SUPI of the user
          required: true
          schema:
            $ref: 'TS29571_CommonData.yaml#/components/schemas/Supi'
        - name: hssAuthType
          in: path
          description: Type of AV requested by HSS
          required: true
          schema:
            $ref: '#/components/schemas/HssAuthTypeInUri'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/HssAuthenticationInfoRequest'
        required: true
      responses:
        '200':
          description: Expected response to a valid request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HssAuthenticationInfoResult'
        '400':
          $ref: 'TS29571_CommonData.yaml#/components/responses/400'
        '404':
          $ref: 'TS29571_CommonData.yaml#/components/responses/404'
        '500':
          $ref: 'TS29571_CommonData.yaml#/components/responses/500'
        '501':
          $ref: 'TS29571_CommonData.yaml#/components/responses/501'
        '503':
          $ref: 'TS29571_CommonData.yaml#/components/responses/503'
        default:
          description: Unexpected error

  /{supi}/auth-events/{authEventId}:
    put:
      summary: Deletes the authentication result in the UDM
      operationId: DeleteAuth
      tags:
        - Delete Auth
      parameters:
        - name: supi
          in: path
          description: SUPI of the user
          required: true
          schema:
            $ref: 'TS29571_CommonData.yaml#/components/schemas/Supi'
        - name: authEventId
          in: path
          description: authEvent Id
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AuthEvent'
        required: true
      responses:
        '204':
          description: Expected response to a successful authentication result removal
        '400':
          $ref: 'TS29571_CommonData.yaml#/components/responses/400'
        '404':
          $ref: 'TS29571_CommonData.yaml#/components/responses/404'
        '500':
          $ref: 'TS29571_CommonData.yaml#/components/responses/500'
        '503':
          $ref: 'TS29571_CommonData.yaml#/components/responses/503'
        default:
          $ref: 'TS29571_CommonData.yaml#/components/responses/default'

components:
  securitySchemes:
    oAuth2ClientCredentials:
      type: oauth2
      flows:
        clientCredentials:
          tokenUrl: '{nrfApiRoot}/oauth2/token'
          scopes:
            nudm-ueau: Access to the nudm-ueau API


  schemas:

# COMPLEX TYPES:

    AuthenticationInfoRequest:
      type: object
      required:
        - servingNetworkName
        - ausfInstanceId
      properties:
        supportedFeatures:
          $ref: 'TS29571_CommonData.yaml#/components/schemas/SupportedFeatures'
        servingNetworkName:
          $ref: '#/components/schemas/ServingNetworkName'
        resynchronizationInfo:
          $ref: '#/components/schemas/ResynchronizationInfo'
        ausfInstanceId:
          $ref: 'TS29571_CommonData.yaml#/components/schemas/NfInstanceId'
        cagId:
          $ref: 'TS29571_CommonData.yaml#/components/schemas/CagId'
        n5gcInd:
          type: boolean
          default: false

    AuthenticationInfoResult:
      type: object
      required:
        - authType
      properties:
        authType:
          $ref: '#/components/schemas/AuthType'
        supportedFeatures:
          $ref: 'TS29571_CommonData.yaml#/components/schemas/SupportedFeatures'
        authenticationVector:
          $ref: '#/components/schemas/AuthenticationVector'
        supi:
          $ref: 'TS29571_CommonData.yaml#/components/schemas/Supi'

    AuthenticationVector:
      oneOf:
        - $ref: '#/components/schemas/AvEapAkaPrime'
        - $ref: '#/components/schemas/Av5GHeAka'
      discriminator:
        propertyName: avType
        mapping:
          5G_HE_AKA: '#/components/schemas/Av5GHeAka'
          EAP_AKA_PRIME: '#/components/schemas/AvEapAkaPrime'

    AvEapAkaPrime:
      type: object
      required:
        - avType
        - rand
        - xres
        - autn
        - ckPrime
        - ikPrime
      properties:
        avType:
          $ref: '#/components/schemas/AvType'
        rand:
          $ref: '#/components/schemas/Rand'
        xres:
          $ref: '#/components/schemas/Xres'
        autn:
          $ref: '#/components/schemas/Autn'
        ckPrime:
          $ref: '#/components/schemas/CkPrime'
        ikPrime:
          $ref: '#/components/schemas/IkPrime'

    Av5GHeAka:
      type: object
      required:
        - avType
        - rand
        - xresStar
        - autn
        - kausf
      properties:
        avType:
          $ref: '#/components/schemas/AvType'
        rand:
          $ref: '#/components/schemas/Rand'
        xresStar:
          $ref: '#/components/schemas/XresStar'
        autn:
          $ref: '#/components/schemas/Autn'
        kausf:
          $ref: '#/components/schemas/Kausf'

    ResynchronizationInfo:
      type: object
      required:
        - rand
        - auts
      properties:
        rand:
          $ref: '#/components/schemas/Rand'
        auts:
          $ref: '#/components/schemas/Auts'

    AuthEvent:
      type: object
      required:
        - nfInstanceId
        - success
        - timeStamp
        - authType
        - servingNetworkName
      properties:
        nfInstanceId:
          $ref: 'TS29571_CommonData.yaml#/components/schemas/NfInstanceId'
        success:
          $ref: '#/components/schemas/Success'
        timeStamp:
          $ref: 'TS29571_CommonData.yaml#/components/schemas/DateTime'
        authType:
          $ref: '#/components/schemas/AuthType'
        servingNetworkName:
          $ref: '#/components/schemas/ServingNetworkName'
        authRemovalInd:
          type: boolean
          default: false

    RgAuthCtx:
      type: object
      required:
        - authInd
      properties:
        authInd:
          type: boolean
          default: false
        supi:
          $ref: 'TS29571_CommonData.yaml#/components/schemas/Supi'
        supportedFeatures:
          $ref: 'TS29571_CommonData.yaml#/components/schemas/SupportedFeatures'

    HssAuthenticationInfoRequest:
      type: object
      required:
        - hssAuthType
        - numOfRequestedVectors
      properties:
        supportedFeatures:
          $ref: 'TS29571_CommonData.yaml#/components/schemas/SupportedFeatures'
        hssAuthType:
          $ref: '#/components/schemas/HssAuthType'
        numOfRequestedVectors:
          $ref: '#/components/schemas/NumOfRequestedVectors'
        servingNetworkId:
          $ref: 'TS29571_CommonData.yaml#/components/schemas/PlmnId'
        resynchronizationInfo:
          $ref: '#/components/schemas/ResynchronizationInfo'
        anId:
          $ref: '#/components/schemas/AccessNetworkId'


    HssAuthenticationInfoResult:
      type: object
      required:
        - hssAuthenticationVectors
      properties:
        supportedFeatures:
          $ref: 'TS29571_CommonData.yaml#/components/schemas/SupportedFeatures'
        hssAuthenticationVectors:
          $ref: '#/components/schemas/HssAuthenticationVectors'

    HssAuthenticationVectors:
      oneOf:
        - type: array
          items:
            $ref: '#/components/schemas/AvEpsAka'
          minItems: 1
          maxItems: 5
        - type: array
          items:
            $ref: '#/components/schemas/AvImsGbaEapAka'
          minItems: 1
          maxItems: 5
        - type: array
          items:
            $ref: '#/components/schemas/AvEapAkaPrime'
          minItems: 1
          maxItems: 5

    AvEpsAka:
      type: object
      required:
        - avType
        - rand
        - xres
        - autn
        - kasme
      properties:
        avType:
          $ref: '#/components/schemas/HssAvType'
        rand:
          $ref: '#/components/schemas/Rand'
        xres:
          $ref: '#/components/schemas/Xres'
        autn:
          $ref: '#/components/schemas/Autn'
        kasme:
          $ref: '#/components/schemas/Kasme'

    AvImsGbaEapAka:
      type: object
      required:
        - avType
        - rand
        - xres
        - autn
        - ck
        - ik
      properties:
        avType:
          $ref: '#/components/schemas/HssAvType'
        rand:
          $ref: '#/components/schemas/Rand'
        xres:
          $ref: '#/components/schemas/Xres'
        autn:
          $ref: '#/components/schemas/Autn'
        ck:
          $ref: '#/components/schemas/ConfidentialityKey'
        ik:
          $ref: '#/components/schemas/IntegrityKey'


# SIMPLE TYPES:

    Autn:
      type: string
      pattern: '^[A-Fa-f0-9]{32}$'

    Auts:
      type: string
      pattern: '^[A-Fa-f0-9]{28}$'

    CkPrime:
      type: string
      pattern: '^[A-Fa-f0-9]{32}$'

    IkPrime:
      type: string
      pattern: '^[A-Fa-f0-9]{32}$'

    Kausf:
      type: string
      pattern: '^[A-Fa-f0-9]{64}$'

    Rand:
      type: string
      pattern: '^[A-Fa-f0-9]{32}$'

    Xres:
      type: string
      pattern: '^[A-Fa-f0-9]{8,32}$'

    XresStar:
      type: string
      pattern: '^[A-Fa-f0-9]{32}$'

    ServingNetworkName:
      type: string
      pattern: '^5G:mnc[0-9]{3}[.]mcc[0-9]{3}[.]3gppnetwork[.]org(:[A-F0-9]{11})?$'

    Success:
      type: boolean

    AuthenticatedInd:
      type: boolean

    ConfidentialityKey:
      type: string
      pattern: '^[A-Fa-f0-9]{32}$'

    IntegrityKey:
      type: string
      pattern: '^[A-Fa-f0-9]{32}$'

    Kasme:
      type: string
      pattern: '^[A-Fa-f0-9]{64}$'

    NumOfRequestedVectors:
      type: integer
      minimum: 1
      maximum: 5


# ENUMS:

    AuthType:
      anyOf:
        - type: string
          enum:
          - 5G_AKA
          - EAP_AKA_PRIME
          - EAP_TLS
        - type: string

    AvType:
      anyOf:
        - type: string
          enum:
          - 5G_HE_AKA
          - EAP_AKA_PRIME
        - type: string

    HssAuthType:
      anyOf:
        - type: string
          enum:
          - EPS_AKA
          - EAP_AKA
          - EAP_AKA_PRIME
          - IMS_AKA
          - GBA_AKA
        - type: string

    HssAvType:
      anyOf:
        - type: string
          enum:
          - EPS_AKA
          - EAP_AKA
          - IMS_AKA
          - GBA_AKA
        - type: string

    HssAuthTypeInUri:
      anyOf:
        - type: string
          enum:
          - eps-aka
          - eap-aka
          - eap-aka-prime
          - ims-aka
          - gba-aka
        - type: string

    AccessNetworkId:
      anyOf:
        - type: string
          enum:
          - HRPD
          - WIMAX
          - WLAN
          - ETHERNET
        - type: string