Internet-Draft DataRight+: Common Resource Set April 2024
Low Expires 3 October 2024 [Page]
Workgroup:
datarightplus
Internet-Draft:
draft-authors-datarightplus-resource-set-common-latest
Published:
Intended Status:
Experimental
Expires:
Author:
S. Low
Biza.io

DataRight+: Common Resource Set

Abstract

This is the resource set profile outlining the common endpoints utilised across multiple industries.

Notational Conventions

The keywords "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in [RFC2119].

Status of This Memo

This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79.

Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet-Drafts is at https://datatracker.ietf.org/drafts/current/.

Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress."

This Internet-Draft will expire on 3 October 2024.

▲

Table of Contents

1. Scope

The scope of this document is intended to be limited to the shared resource server endpoints, and their associated authorisation contexts.

2. Terminology

This specification utilises the various terms outlined within [DATARIGHTPLUS-ROSETTA].

3. Providers

Providers are expected to deliver a set of common resource server endpoints.

3.1. Authorisation Server

In addition to other provisions incorporated within the relevant ecosystem set, the Provider authorisation server SHALL:

  1. Support the [RFC6749] scope parameter with possible values outlined within Authorisation Scopes;

3.1.1. Authorisation Scopes

The Provider authorisation server SHALL utilise the following Data Set Language when seeking authorisation from a Consumer representing an Individual for specific scope values:

Table 1
scope value Data Set Language
common:customer.basic:read Name and occupation
Name;
Occupation;
common:customer.detail:read Contact Details
Phone;
Email address;
Mail address;
Residential address;

The Provider authorisation server SHALL utilise the following Data Set Language when seeking authorisation from a Consumer representing an Entity for specific scope values:

Table 2
scope value Data Set Language
common:customer.basic:read Organisation profile
Agent name and role;
Organisation name;
Organisation numbers (ABN or ACN);
Charity status;
Establishment date;
Industry;
Organisation type
Country of registration;
common:customer.detail:read Organisation contact details
Organisation address;
Mail address;
Phone number;

3.1.2. Overlapping Scope Optimisation

Alternative Data Cluster Language SHALL be used for Consumers representing Individuals when pairs of scope value are used as follows:

Table 3
scope pairing Data Set Language
common:customer.basic:read and Name, occupation, contact details
common:customer.detail:read Name;
Occupation;
Phone;
Email address;
Mail address;
Residential address;

Alternative Data Cluster Language SHALL be used for Consumers representing Entities when pairs of scope value are used as follows:

Table 4
scope pairing Data Set Language
common:customer.basic:read and Organisation profile and contact details
common:customer.detail:read Agent name and role;
Organisation name;
Organisation numbers (ABN or ACN);
Charity status;
Establishment date;
Industry;
Organisation type;
Country of registration;
Organisation address;
Mail address;
Phone number;

3.2. Resource Server

The Provider SHALL make available, as described further in [DATARIGHTPLUS-REDOCLY-ID1] endpoints, the following endpoints where the token is granted the common:customer.basic:read scope value:

Table 5
Resource Server Endpoint Authorisation Scope x-v
GET /common/customer common:customer.basic:read 1

The Provider SHALL make available, as described further in [DATARIGHTPLUS-REDOCLY-ID1] endpoints, the following endpoint where the token is granted the common:customer.basic:detail scope value:

Table 6
Resource Server Endpoint Authorisation Scope x-v
GET /common/customer/detail common:customer.basic:detail 1

The Provider SHALL also deliver the following unauthenticated and generally available endpoints, in accordance with [DATARIGHTPLUS-REDOCLY-ID1]:

Table 7
Resource Server Endpoint x-v
GET /discovery/outages 1
GET /discovery/status 1

4. Initiators

Initiators SHALL describe the requested scope values using the same Data Set Language as Providers, as outlined in Authorisation Scopes.

5. Acknowledgement

The following people contributed to this document:

We acknowledge the contribution to the [CDS] of the following individuals:

6. Normative References

[CDS]
Data Standards Body (Treasury), "Consumer Data Standards (CDS)", <https://consumerdatastandardsaustralia.github.io/standards>.
[DATARIGHTPLUS-REDOCLY-ID1]
Low, S., Kolera, B., and W. Cai, "DataRight+: Redocly (ID1)", <https://datarightplus.github.io/datarightplus-redocly/?v=ID1>.
[DATARIGHTPLUS-ROSETTA]
Low, S., "DataRight+ Rosetta Stone", <https://datarightplus.github.io/datarightplus-rosetta/draft-authors-datarightplus-rosetta.html>.
[RFC2119]
Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, DOI 10.17487/RFC2119, , <https://www.rfc-editor.org/info/rfc2119>.
[RFC6749]
Hardt, D., Ed., "The OAuth 2.0 Authorization Framework", RFC 6749, DOI 10.17487/RFC6749, , <https://www.rfc-editor.org/info/rfc6749>.

Author's Address

Stuart Low
Biza.io