[Confidential Computing Ledger] API Review

[azure-sdk]

New API Review meeting has been requested.

Service Name: Azure Confidential Computing Ledger Review Created By: Yagnesh Setti Subramanian Review Date: 4/19/2023 9:00 AM PT PR: #23627 Hero Scenarios Link: Not Provided Core Concepts Doc Link: Not Provided

Description: Managed CCF is a platform offering. Customers can create applications targeting the CCF framework. CCF provides data plane Apis to perform administrative operations on an instance. This meeting is to review the data plane Api specification

Detailed meeting information and documents provided can be accessed here For more information that will help prepare you for this review, the requirements, and office hours, visit the documentation here

[mikekistler]

Notes from API Review Meeting 4/19/23

• General information on CCF is available at ccf.dev
• Should document the signing protocol in descriptions (@doc)
• Please use the POST Action pattern, with ":" in the path
• The body of "/gov:ack" should be "application/coze"
  • Maybe the MIME types from https://datatracker.ietf.org/doc/html/rfc8152#section-16.9.2
• All operations should have an api-version query parameter
• The TypeSpec must be reworked to use Azure Core, with suppressions if needed.
• Post Actions should generally return 200 with an empty object. Returning 204 is acceptable if you are certain that you will never need to change to return a body.
• Custom headers should not be prefixed with "X-" unless it is needed for consistency with existing service
• Properties in JSON bodies should be camel-cased
• We discourage POST for creating resources because it is not idempotent. PATCH is much better because it is naturally idempotent and version resilient.
  • Or use the OASIS Repeatability Headers to ensure repeatability
  • Creating a proposal may be idempotent because they must contain a timestamp and that must be unique
    • But service should not return an error for a retried create -- return 200 success

[achamayou]

@mikekistler thank you, we will work to make these changes, and seek help from the TypeSpec team on how best to describe JSON payloads wrapped in "application/cose"/COSE Sign1 envelopes.

We will also add documentation about the replay protection mechanism and how it enforces idempotence for proposal creation. We will look at switching to PATCH or PUT for the ballots.

[azure-sdk]

New API Review meeting has been requested.

Service Name: Azure Confidential Computing Ledger - Azure Managed Confidential Consortium Framework Review Created By: Yagnesh Setti Subramanian Review Date: 05/24/2023 09:00 AM PT PR: https://github.com/Azure/azure-rest-api-specs/pull/23627 Hero Scenarios Link: Not Provided Core Concepts Doc Link: Not Provided

Description: Managed CCF is a platform offering. Customers can create applications targeting the CCF framework. CCF provides data plane Apis to perform administrative operations on an instance. This meeting is to review the data plane Api specification

Detailed meeting information and documents provided can be accessed here For more information that will help prepare you for this review, the requirements, and office hours, visit the documentation here

[markweitzel]

API Stewardship Board Review: 24-May-23

Correct PR: #23627

• constitution endpoint, consider changing the content type to text/javascript
• We need a better way to capture this more effectively in TypeSpec
• New issues for typespec:
  • https://github.com/Azure/azure-sdk-tools/issues/6223
  • https://github.com/microsoft/typespec/issues/1975
• Please also look at the PR for additional comments.

Next Steps

• Approved for Preview. Would like to revisit before GA.

Resources

• Meeting Recording