camaraproject / DeviceStatus

Repository to describe, develop, document and test the Device Status API family
Apache License 2.0
11 stars 33 forks source link

When roaming status is true, is it mandatory to return both countryCode and countryName? #124

Closed trehman-gsma closed 3 months ago

trehman-gsma commented 4 months ago

Context is the response object for POST /roaming v0.5.0:

    RoamingStatusResponse:
      type: object
      required:
        - roaming
      properties:
        roaming:
          $ref: "#/components/schemas/ActiveRoaming"
        countryCode:
          $ref: "#/components/schemas/CountryCode"
        countryName:
          $ref: "#/components/schemas/CountryName"

When roaming is returned as true, is it mandatory to also return both countryCode and countryName?

Could an operator choose to omit countryCode and countryName for privacy reasons?

sachinvodafone commented 4 months ago

Hi @trehman-gsma , as per specification , only 'roaming' (true or false) field is required and other two (countryCode & countryName) are optional.

trehman-gsma commented 4 months ago

Hi @sachinvodafone,

The in-line documentation in the spec currently states: when the device is in roaming situation, visited country information is send back in the response.

Some may imply this to mean that country information is mandatory to be returned when the device is roaming. Do you think the doc needs updating? Or does this add another perspective to your view of country information being optional?

sachinvodafone commented 4 months ago

Hi @trehman-gsma Thank you for pointing out the oversight. As per the documentation, it makes sense to include countryName and countryCode in the response when the device is in roaming. I can't recall any privacy usecase where the API server should omit these values. In such situations (if any), the API response should adhere to the specific "purpose of accessing the data," outlined in the “IdentityandConsentManagement” documentation. This might involve defining two different scopes—one to send only the roaming status and the other to send all three attributes—or alternatively, defining two separate endpoints. However, it's essential to highlight and assess these use cases (if any) to determine their relevance, and real-world applicability to make any change in our current design/specification. So as per my view , there's no need to make any changes at this point, considering that the API should consistently sends countryName and countryCode when the device is in roaming.

trehman-gsma commented 4 months ago

This issue was discussed during DeviceStatus meeting on 13-03-24. It was agreed that country information is optional in cases of roaming=true. PR #127 created to update documentation.

trehman-gsma commented 4 months ago

Hello @sachinvodafone @bigludo7 @akoshunyadi,

I have a related question on top of what was discussed during the DeviceStatus meeting on 13-03-24. I can create a new issue if required.

When roaming status is false, can country information also be optionally returned?

bigludo7 commented 4 months ago

Hello @trehman-gsma Looking in the API documentation:

Country : Country code and name - visited country information, provided if the device is in roaming situation.

So I do not expect country in not roaming situation but this is perhaps unfair to deny conformance.

The major point for me is that country information is optional (even for roaming situation) and we need to be very clear to the API consumer that this API cannot be considered as a sure thing to get the country where the device is.