rfc9944v2.txt		rfc9944.txt
	skipping to change at line 278 ¶		skipping to change at line 278 ¶
	OpenAPI versions do not have a means to express case sensitivity, and		OpenAPI versions do not have a means to express case sensitivity, and
	thus attributes that are not case sensitive must be manually		thus attributes that are not case sensitive must be manually
	validated.		validated.
	Several additional schemas specify specific onboarding mechanisms,		Several additional schemas specify specific onboarding mechanisms,
	such as Bluetooth Low Energy (BLE) [BLE54], Wi-Fi Easy Connect		such as Bluetooth Low Energy (BLE) [BLE54], Wi-Fi Easy Connect
	[DPP2], and FIDO Device Onboard [FDO11].		[DPP2], and FIDO Device Onboard [FDO11].
	1.4. Schema Representation		1.4. Schema Representation
	Attributes defined in the device core schema and extensions comprise		Attributes defined in the device core schema (see Section 2.2 of
	characteristics and SCIM datatypes defined in Sections 2.2 and 2.3 of		[RFC7643]) and extensions comprise characteristics and the SCIM
	[RFC7643]. This specification does not define new characteristics		datatypes (defined in Section 2.3 of [RFC7643]). This specification
	and datatypes for the SCIM attributes.		does not define new characteristics and datatypes for the SCIM
			attributes.
	1.5. Terminology		1.5. Terminology
	The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",		The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
	"SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and		"SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and
	"OPTIONAL" in this document are to be interpreted as described in		"OPTIONAL" in this document are to be interpreted as described in
	BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all		BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all
	capitals, as shown here.		capitals, as shown here.
	The reader is also expected to be familiar with the narrative schema		The reader is also expected to be familiar with the narrative schema
	skipping to change at line 305 ¶		skipping to change at line 306 ¶
	A new resource type 'Device' is specified. The "ResourceType" schema		A new resource type 'Device' is specified. The "ResourceType" schema
	specifies the metadata about a resource type (see Section 6 of		specifies the metadata about a resource type (see Section 6 of
	[RFC7643]). It comprises a core device schema and several extension		[RFC7643]). It comprises a core device schema and several extension
	schemas. This schema provides a minimal resource representation,		schemas. This schema provides a minimal resource representation,
	whereas extension schemas extend it depending on the device's		whereas extension schemas extend it depending on the device's
	capability.		capability.
	2.1. Common Attributes		2.1. Common Attributes
	The Device schema contains three common attributes as defined in		The device schema contains three common attributes as defined in
	Section 3.1 of [RFC7643]. No semantic or syntax changes are made		Section 3.1 of [RFC7643]. No semantic or syntax changes are made
	here, but the attributes are listed merely for completeness.		here, but the attributes are listed merely for completeness.
	id: A required and unique attribute of the core device schema (see		id: A required and unique attribute of the core device schema (see
	Section 3.1 of [RFC7643]).		Section 3.1 of [RFC7643]).
	externalId: An optional attribute (see Section 3.1 of [RFC7643]).		externalId: An optional attribute (see Section 3.1 of [RFC7643]).
	meta: A required and complex attribute (see Section 3.1 of		meta: A required and complex attribute (see Section 3.1 of
	[RFC7643]).		[RFC7643]).
	skipping to change at line 339 ¶		skipping to change at line 340 ¶
	displayName: A string that provides a human-readable name for a		displayName: A string that provides a human-readable name for a
	device. It is intended to be displayed to end users and should be		device. It is intended to be displayed to end users and should be
	suitable for that purpose. The attribute is not required and is		suitable for that purpose. The attribute is not required and is
	not case sensitive. It may be modified and SHOULD be returned by		not case sensitive. It may be modified and SHOULD be returned by
	default. No uniqueness constraints are imposed on this attribute.		default. No uniqueness constraints are imposed on this attribute.
	active: A mutable boolean that is required. If set to TRUE, it		active: A mutable boolean that is required. If set to TRUE, it
	means that this device is intended to be operational. Attempts to		means that this device is intended to be operational. Attempts to
	control or access a device where this value is set to FALSE may		control or access a device where this value is set to FALSE may
	fail. For example, when used in conjunction with Non-IP Device		fail. For example, when used in conjunction with Non-Internet-
	Control (NIPC) [NIPC], commands such as connect, disconnect, and		Connected Physical Components (NIPC) [NIPC], commands (such as
	subscribe that control application sends to the controller for the		connect, disconnect, and subscribe) that control application sends
	devices any command will be rejected by the controller.		to the controller for devices will be rejected by the controller.
	mudUrl: A string that represents the URL to the Manufacturer Usage		mudUrl: A string that represents the URL to the Manufacturer Usage
	Description (MUD) file associated with this device. This		Description (MUD) file associated with this device. This
	attribute is optional and mutable. The mudUrl value is case		attribute is optional, mutable, and returned by default. When
	sensitive and not unique. When present, this attribute may be		present, this attribute may be used as described in [RFC8520].
	used as described in [RFC8520]. This attribute is case sensitive		The mudUrl value is case sensitive and not unique.
	and returned by default.
	groups: An optional read-only complex object that indicates group		groups: An optional read-only complex object that indicates group
	membership. Its form is precisely the same as that defined in		membership. Its form is precisely the same as that defined in
	Section 4.1.2 of [RFC7643].		Section 4.1.2 of [RFC7643].
	+=============+=======+=====+=======+=========+========+========+		+=============+=======+=====+=======+=========+========+========+
	| Attribute | Multi | Req | Case | Mutable | Return | Unique |		| Attribute | Multi | Req | Case | Mutable | Return | Unique |
	| | Value | | Exact | | | |		| | Value | | Exact | | | |
	+=============+=======+=====+=======+=========+========+========+		+=============+=======+=====+=======+=========+========+========+
	| displayName | F | F | F | RW | Def | None |		| displayName | F | F | F | RW | Def | None |
	skipping to change at line 467 ¶		skipping to change at line 467 ¶
	6.3. Complex Attributes		6.3. Complex Attributes
	6.3.1. certificateInfo		6.3.1. certificateInfo
	certificateInfo is a complex attribute that contains an X.509		certificateInfo is a complex attribute that contains an X.509
	certificate's subject name and root Certificate Authority (CA)		certificate's subject name and root Certificate Authority (CA)
	information associated with application clients that will connect for		information associated with application clients that will connect for
	purposes of device control or telemetry.		purposes of device control or telemetry.
	rootCA: A base64-encoded string as described in Section 4 of		rootCA: A base64-encoded string as described in Section 4 of
	[RFC4648] a trust anchor certificate. This trust anchor is		[RFC4648]. It is a trust anchor certificate applicable for
	applicable for certificates used for client application access.		certificates used for client application access. The object is
	The object is not required, singular, case sensitive, and read/		not required. It is singular, case sensitive, and read/write. If
	write. If not present, a set of trust anchors MUST be configured		not present, a set of trust anchors MUST be configured out of
	out of band.		band.
	subjectName: When present, a string that contains one of two names:		subjectName: When present, a string that contains one of two names:
	* a distinguished name that will be present in the certificate		* a distinguished name that will be present in the certificate
	subject field, as described in Section 4.1.2.4 of [RFC5280] or		subject field, as described in Section 4.1.2.4 of [RFC5280] or
	* a dnsName as part of a subjectAlternateName, as described in		* a dnsName as part of a subjectAlternateName, as described in
	Section 4.2.1.6 of [RFC5280].		Section 4.2.1.6 of [RFC5280].
	In the latter case, servers validating such certificates SHALL		In the latter case, servers validating such certificates SHALL
	skipping to change at line 513 ¶		skipping to change at line 513 ¶
	| subjectName | F |T | T | RW | Def | None |		| subjectName | F |T | T | RW | Def | None |
	+-----------------+-------+---+-------+---------+--------+--------+		+-----------------+-------+---+-------+---------+--------+--------+
	Table 2: Characteristics of EndpointApp Schema Attributes		Table 2: Characteristics of EndpointApp Schema Attributes
	Legend:		Legend:
	Req: Required		Req: Required
	T: True		T: True
	F: False		F: False
	R: ReadOnly		RO: ReadOnly
	RW: ReadWrite		RW: ReadWrite
	Manuf: Manufacturer
	N: No		N: No
	Def: Default		Def: Default
	Note that either clientToken or certificateInfo is used for the		Note that either clientToken or certificateInfo is used for the
	authentication of the application. If certificateInfo is NOT present		authentication of the application. If certificateInfo is NOT present
	when an endpointApp object is created, then the server SHOULD return		when an endpointApp object is created, then the server SHOULD return
	a clientToken. Otherwise, if the server accepts the certificateInfo		a clientToken. Otherwise, if the server accepts the certificateInfo
	object for authentication, it SHOULD NOT return a clientToken. If		object for authentication, it SHOULD NOT return a clientToken. If
	the server accepts and produces a clientToken, then control and		the server accepts and produces a clientToken, then control and
	telemetry servers MUST validate both. The SCIM client will know that		telemetry servers MUST validate both. The SCIM client will know that
	skipping to change at line 557 ¶		skipping to change at line 556 ¶
	"location": "https://example.com/v2/EndpointApps/e9e30dba-f08f-\		"location": "https://example.com/v2/EndpointApps/e9e30dba-f08f-\
	4109-8486-d5c6a3316212"		4109-8486-d5c6a3316212"
	}		}
	}		}
	<CODE ENDS>		<CODE ENDS>
	Figure 4: Endpoint App Example		Figure 4: Endpoint App Example
	7. SCIM Device Extensions		7. SCIM Device Extensions
	SCIM provides various extension schemas, their attributes, JSON		SCIM provides various extension schemas and their attributes, along
	representation, and example object. The core schema is extended with		with JSON representations and example objects. The core schema is
	a new resource type, Device. No schemaExtensions list is specified		extended with a new resource type, Device. No schemaExtensions list
	in that definition. Instead, IANA registry entries have been		is specified in that definition. Instead, IANA registry entries have
	created, where all values for "required" are set to false. All		been created, where all values for "required" are set to false. All
	extensions to the Device schema MUST be registered via IANA, as		extensions to the device schema MUST be registered via IANA, as
	described in Section 9.2. The schemas below demonstrate how this		described in Section 9.2. The schemas below demonstrate how this
	model is to work. All the SCIM server-related schema URIs are valid		model is to work. All the SCIM server-related schema URIs are valid
	only with Device resource types.		only with Device resource types.
	7.1. Bluetooth Low Energy (BLE) Extension		7.1. Bluetooth Low Energy (BLE) Extension
	This schema extends the device schema to represent the devices		This schema extends the device schema to represent the devices
	supporting BLE. The extension is identified using the following		supporting BLE. The extension is identified using the following
	schema URI:		schema URI:
	skipping to change at line 587 ¶		skipping to change at line 586 ¶
	7.1.1. Singular Attributes		7.1.1. Singular Attributes
	deviceMacAddress: A string value that represents a public MAC		deviceMacAddress: A string value that represents a public MAC
	address assigned by the manufacturer. It is a unique 48-bit		address assigned by the manufacturer. It is a unique 48-bit
	value. It is required, case insensitive, mutable, and returned by		value. It is required, case insensitive, mutable, and returned by
	default. The ECMA regular expression pattern [ECMA] is the		default. The ECMA regular expression pattern [ECMA] is the
	following:		following:
	^[0-9A-Fa-f]{2}(:[0-9A-Fa-f]{2}){5}$		^[0-9A-Fa-f]{2}(:[0-9A-Fa-f]{2}){5}$
	isRandom: A boolean flag taken from [BLE54]. If FALSE, the device		isRandom: A boolean flag. If FALSE, the device is using a public
	is using a public MAC address. If TRUE, the device uses a random		MAC address. If TRUE, the device uses a random address. If an
	address. If an Identifying Resolving Key (IRK) is present, the		Identifying Resolving Key (IRK) is present, the address represents
	address represents a resolvable private address. Otherwise, the		a resolvable private address. Otherwise, the address is assumed
	address is assumed to be a random static address. Non-resolvable		to be a random static address. Non-resolvable private addresses
	private addresses are not supported by this specification. This		are not supported by this specification. This attribute is not
	attribute is not required. It is mutable and is returned by		required. It is mutable and is returned by default. The default
	default. The default value is FALSE.		value is FALSE. See Volume 6, Part B, Section 1.3 of [BLE54] for
			more information about different address types.
	separateBroadcastAddress: When present, this string represents an		separateBroadcastAddress: When present, this string represents an
	address used for broadcasts/advertisements. This value MUST NOT		address used for broadcasts/advertisements. This value MUST NOT
	be set when an IRK is provided. Its form is the same as		be set when an IRK is provided. Its form is the same as
	deviceMacAddress. It is not required, multivalued, mutable, and		deviceMacAddress. It is not required, multivalued, mutable, and
	returned by default.		returned by default.
	irk: A string value that specifies the IRK, which is unique to each		irk: A string value that specifies the IRK, which is unique to each
	device. It is used to resolve a private random address. It		device. It is used to resolve a private random address. It
	should only be provisioned when isRandom is TRUE. It is mutable		should only be provisioned when isRandom is TRUE. It is mutable
	and never returned. For more information about the use of the		and never returned. For more information about the use of the
	IRK, see Volume 1, Part A, Section 5.4.5 of [BLE54].		IRK, see Volume 1, Part A, Section 5.4.5 of [BLE54].
	mobility: A boolean attribute to enable BLE device mobility. If set		mobility: A boolean attribute to enable BLE device mobility. If set
	to TRUE, the device could be expected to move within a network of		to TRUE, the device could be expected to move within a network of
	APs. For example, if a BLE device is connected with AP-1 and		Access Points (APs). For example, if a BLE device is connected
	moves out of range but comes in range of AP-2, it will be		with AP-1 and moves out of range but comes in range of AP-2, it
	disconnected with AP-1 and connected with AP-2. It is returned by		will be disconnected with AP-1 and connected with AP-2. It is
	default and mutable.		returned by default and mutable.
	7.1.2. Multivalued Attributes		7.1.2. Multivalued Attributes
	versionSupport: A multivalued set of strings that specifies the BLE		versionSupport: A multivalued set of strings that specifies the BLE
	versions supported by the device in the form of an array, for		versions supported by the device in the form of an array, for
	example, ["4.1", "4.2", "5.0", "5.1", "5.2", "5.3", "5.4"]. It is		example, ["4.1", "4.2", "5.0", "5.1", "5.2", "5.3", "5.4"]. It is
	required, mutable, and returned by default.		required, mutable, and returned by default.
	pairingMethods: A multivalued set of strings that specifies pairing		pairingMethods: A multivalued set of strings that specifies pairing
	methods associated with the BLE device. The pairing methods may		methods associated with the BLE device. The pairing methods may
	skipping to change at line 639 ¶		skipping to change at line 639 ¶
	is required, case sensitive, mutable, and returned by default.		is required, case sensitive, mutable, and returned by default.
	7.1.3. BLE Pairing Method Extensions		7.1.3. BLE Pairing Method Extensions
	The details on pairing methods and their associated attributes are in		The details on pairing methods and their associated attributes are in
	Volume 1, Part A, Section 5.2.4 of [BLE54]. This memo defines		Volume 1, Part A, Section 5.2.4 of [BLE54]. This memo defines
	extensions for four pairing methods that are nested inside the BLE		extensions for four pairing methods that are nested inside the BLE
	extension schema. Each extension contains the common attributes in		extension schema. Each extension contains the common attributes in
	Section 6.1. These extensions are as follows:		Section 6.1. These extensions are as follows:
	i. The pairingNull extension is identified using the following		pairingNull extension: Identified using the following schema URI:
	schema URI:
	urn:ietf:params:scim:schemas:extension:pairingNull:2.0:Device		urn:ietf:params:scim:schemas:extension:pairingNull:2.0:Device
	pairingNull does not have any attribute. It allows pairing for		pairingNull does not have any attribute. It allows pairing for
	BLE devices that do not require a pairing method.		BLE devices that do not require a pairing method.
	ii. The pairingJustWorks extension is identified using the		pairingJustWorks extension: Identified using the following schema
	following schema URI:		URI:
	urn:ietf:params:scim:schemas:extension:pairingJustWorks:2.0:Device		urn:ietf:params:scim:schemas:extension:pairingJustWorks:2.0:Device
	The Just Works pairing method does not require a key to pair		The Just Works pairing method does not require a key to pair
	devices. For completeness, the key attribute is included and		devices. For completeness, the key attribute is included and is
	is set to 'null'. The key attribute is required, immutable,		set to 'null'. The key attribute is required, immutable, and
	and returned by default.		returned by default.
	iii. The pairingPassKey extension is identified using the following		pairingPassKey extension: Identified using the following schema URI:
	schema URI:
	urn:ietf:params:scim:schemas:extension:pairingPassKey:2.0:Device		urn:ietf:params:scim:schemas:extension:pairingPassKey:2.0:Device
	The passkey pairing method requires a 6-digit key to pair		The passkey pairing method requires a 6-digit key to pair devices.
	devices. This extension has one singular integer attribute,		This extension has one singular integer attribute, "key", which is
	"key", which is required, mutable, and returned by default.		required, mutable, and returned by default. The key pattern is as
	The key pattern is as follows:		follows:
	^[0-9]{6}$		^[0-9]{6}$
	iv. The pairingOOB extension is identified using the following		pairingOOB extension: Identified using the following schema URI:
	schema URI:
	urn:ietf:params:scim:schemas:extension:pairingOOB:2.0:Device		urn:ietf:params:scim:schemas:extension:pairingOOB:2.0:Device
	The out-of-band (OOB) pairing method includes three singular		The out-of-band (OOB) pairing method includes three singular
	attributes: key, randomNumber, and confirmationNumber.		attributes: key, randomNumber, and confirmationNumber.
	key: A string value that is required and received from out-of-		key:
	band sources such as Near Field Communication (NFC). It is		A string value that is required and received from out-of-band
	case sensitive, mutable, and returned by default.		sources such as Near Field Communication (NFC). It is case
			sensitive, mutable, and returned by default.
	randomNumber: An integer that represents a nonce added to the		randomNumber:
	key. It is a required attribute. It is mutable and		An integer that represents a nonce added to the key. It is a
	returned by default.		required attribute. It is mutable and returned by default.
	confirmationNumber: An integer that some solutions require in		confirmationNumber:
	a RESTful message exchange. It is not required. It is		An integer that some solutions require in a RESTful message
	mutable and returned by default if it exists.		exchange (where RESTful refers to the Representational State
			Transfer (REST) architecture). It is not required. It is
			mutable and returned by default if it exists.
	+==================+=======+===+=======+=========+========+========+		+==================+=======+===+=======+=========+========+========+
	| Attribute | Multi |Req| Case | Mutable | Return | Unique |		| Attribute | Multi |Req| Case | Mutable | Return | Unique |
	| | Value | | Exact | | | |		| | Value | | Exact | | | |
	+==================+=======+===+=======+=========+========+========+		+==================+=======+===+=======+=========+========+========+
	| deviceMacAddress | F |T | F | RW | Def | Manuf |		| deviceMacAddress | F |T | F | RW | Def | Manuf |
	+------------------+-------+---+-------+---------+--------+--------+		+------------------+-------+---+-------+---------+--------+--------+
	| isRandom | F |T | F | RW | Def | None |		| isRandom | F |T | F | RW | Def | None |
	+------------------+-------+---+-------+---------+--------+--------+		+------------------+-------+---+-------+---------+--------+--------+
	| sepBroadcastAdd | T |F | F | RW | Def | None |		| sepBroadcastAdd | T |F | F | RW | Def | None |
	skipping to change at line 717 ¶		skipping to change at line 717 ¶
	Table 3: Characteristics of BLE Extension Schema Attributes		Table 3: Characteristics of BLE Extension Schema Attributes
	Legend:		Legend:
	sepBroadcastAdd: separateBroadcastAddress		sepBroadcastAdd: separateBroadcastAddress
	Req: Required		Req: Required
	T: True		T: True
	F: False		F: False
	RW: ReadWrite		RW: ReadWrite
	WO: Write Only		WO: WriteOnly
	Def: Default		Def: Default
	Nev: Never		Nev: Never
	Manuf: Manufacturer		Manuf: Manufacturer
	<CODE BEGINS>		<CODE BEGINS>
	{		{
	"schemas": ["urn:ietf:params:scim:schemas:core:2.0:Device",		"schemas": ["urn:ietf:params:scim:schemas:core:2.0:Device",
	"urn:ietf:params:scim:schemas:extension:ble:2.0:Device"],		"urn:ietf:params:scim:schemas:extension:ble:2.0:Device"],
	"id": "e9e30dba-f08f-4109-8486-d5c6a3316111",		"id": "e9e30dba-f08f-4109-8486-d5c6a3316111",
	skipping to change at line 845 ¶		skipping to change at line 845 ¶
	"location": "https://example.com/v2/Devices/e9e30dba-f08f-4109-\		"location": "https://example.com/v2/Devices/e9e30dba-f08f-4109-\
	8486-d5c6a3316111"		8486-d5c6a3316111"
	}		}
	}		}
	<CODE ENDS>		<CODE ENDS>
	Figure 7: BLE Pairing with Both Passkey and OOB		Figure 7: BLE Pairing with Both Passkey and OOB
	7.2. Wi-Fi Easy Connect Extension		7.2. Wi-Fi Easy Connect Extension
	A schema that extends the device schema to enable Wi-Fi Easy Connect		This section describes a schema that extends the device schema to
	(otherwise known as Device Provisioning Protocol (DPP)). Throughout		enable Wi-Fi Easy Connect (otherwise known as Device Provisioning
	this specification, we use the term "DPP". The extension is		Protocol (DPP)). Throughout this specification, we use the term
	identified using the following schema URI:		"DPP". The extension is identified using the following schema URI:
	urn:ietf:params:scim:schemas:extension:dpp:2.0:Device		urn:ietf:params:scim:schemas:extension:dpp:2.0:Device
	The attributes in this extension are adopted from [DPP2]. The		The attributes in this extension are adopted from [DPP2]. The
	attributes are as follows.		attributes are as follows.
	7.2.1. Singular Attributes		7.2.1. Singular Attributes
	dppVersion: An integer that represents the version of DPP the device		dppVersion: An integer that represents the version of DPP the device
	supports. This attribute is required, case insensitive, mutable,		supports. This attribute is required, case insensitive, mutable,
	skipping to change at line 913 ¶		skipping to change at line 913 ¶
	+---------------------+-----+---+-----+---------+--------+--------+		+---------------------+-----+---+-----+---------+--------+--------+
	Table 4: Characteristics of DPP Extension Schema Attributes		Table 4: Characteristics of DPP Extension Schema Attributes
	Legend:		Legend:
	Req: Required		Req: Required
	T: True		T: True
	F: False		F: False
	RW: ReadWrite		RW: ReadWrite
	WO: Write Only		WO: WriteOnly
	Def: Default		Def: Default
	Nev: Never		Nev: Never
	Manuf: Manufacturer		Manuf: Manufacturer
	<CODE BEGINS>		<CODE BEGINS>
	{		{
	"schemas": ["urn:ietf:params:scim:schemas:core:2.0:Device",		"schemas": ["urn:ietf:params:scim:schemas:core:2.0:Device",
	"urn:ietf:params:scim:schemas:extension:dpp:2.0:\		"urn:ietf:params:scim:schemas:extension:dpp:2.0:\
	Device"],		Device"],
	skipping to change at line 1081 ¶		skipping to change at line 1081 ¶
	"location": "https://example.com/v2/Devices/e9e30dba-f08f-4109-\		"location": "https://example.com/v2/Devices/e9e30dba-f08f-4109-\
	8486-d5c6a3316111"		8486-d5c6a3316111"
	}		}
	}		}
	<CODE ENDS>		<CODE ENDS>
	Figure 10: FDO Example		Figure 10: FDO Example
	7.5. Zigbee Extension		7.5. Zigbee Extension
	A schema that extends the device schema to enable the provisioning of		This section describes a schema that extends the device schema to
	Zigbee devices [Zigbee]. The extension is identified using the		enable the provisioning of Zigbee devices [Zigbee]. The extension is
	following schema URI:		identified using the following schema URI:
	urn:ietf:params:scim:schemas:extension:zigbee:2.0:Device		urn:ietf:params:scim:schemas:extension:zigbee:2.0:Device
	It has one singular attribute and one multivalued attribute. The		It has one singular attribute and one multivalued attribute. The
	attributes are as follows.		attributes are as follows.
	7.5.1. Singular Attribute		7.5.1. Singular Attribute
	deviceEui64Address: A 64-bit Extended Unique Identifier (EUI-64)		deviceEui64Address: A 64-bit Extended Unique Identifier (EUI-64)
	device address stored as string. This attribute is required, case		device address stored as string. This attribute is required, case
	skipping to change at line 1151 ¶		skipping to change at line 1151 ¶
	8486-d5c6a3316111"		8486-d5c6a3316111"
	}		}
	}		}
	<CODE ENDS>		<CODE ENDS>
	Figure 11: Zigbee Example		Figure 11: Zigbee Example
	7.6. The Endpoint Applications Extension Schema		7.6. The Endpoint Applications Extension Schema
	Sometimes non-IP devices such as those using BLE or Zigbee require an		Sometimes non-IP devices such as those using BLE or Zigbee require an
	application gateway interface to manage them. SCIM clients MUST NOT		application gateway interface to manage them.
	specify this to describe native IP-based devices.
	endpointAppsExt provides the list of applications that connect to an		endpointAppsExt provides the list of applications that connect to an
	enterprise gateway. endpointAppsExt has one multivalued attribute and		enterprise gateway. endpointAppsExt has one multivalued attribute and
	two singular attributes. The extension is identified using the		two singular attributes. The extension is identified using the
	following schema URI:		following schema URI:
	urn:ietf:params:scim:schemas:extension:endpointAppsExt:2.0:Device		urn:ietf:params:scim:schemas:extension:endpointAppsExt:2.0:Device
	7.6.1. Singular Attributes		7.6.1. Singular Attributes
	skipping to change at line 1224 ¶		skipping to change at line 1223 ¶
	Table 8: Characteristics of EndpointAppsExt Extension Schema		Table 8: Characteristics of EndpointAppsExt Extension Schema
	Attributes		Attributes
	Legend:		Legend:
	devContEntEndpoint: deviceControlEnterpriseEndpoint		devContEntEndpoint: deviceControlEnterpriseEndpoint
	telEntEndpoint: telemetryEnterpriseEndpoint		telEntEndpoint: telemetryEnterpriseEndpoint
	Req: Required		Req: Required
	T: True		T: True
	F: False		F: False
	R: ReadOnly		RO: ReadOnly
	RW: ReadWrite		RW: ReadWrite
	Ent: Enterprise		Ent: Enterprise
	Def: Default		Def: Default
	<CODE BEGINS>		<CODE BEGINS>
	{		{
	"schemas": ["urn:ietf:params:scim:schemas:core:2.0:Device",		"schemas": ["urn:ietf:params:scim:schemas:core:2.0:Device",
	"urn:ietf:params:scim:schemas:extension:ble:2.0:Device",		"urn:ietf:params:scim:schemas:extension:ble:2.0:Device",
	"urn:ietf:params:scim:schemas:extension:endpointAppsExt:2.0:\		"urn:ietf:params:scim:schemas:extension:endpointAppsExt:2.0:\
	Device"],		Device"],
	skipping to change at line 1369 ¶		skipping to change at line 1368 ¶
	SCIM logs. Due to the sensitive nature of SCIM operations, logs		SCIM logs. Due to the sensitive nature of SCIM operations, logs
	SHOULD be encrypted both on the disk and in transit.		SHOULD be encrypted both on the disk and in transit.
	9. IANA Considerations		9. IANA Considerations
	9.1. New Schemas		9.1. New Schemas
	IANA has added the following additions to the "SCIM Schema URIs for		IANA has added the following additions to the "SCIM Schema URIs for
	Data Resources" registry:		Data Resources" registry:
	+====================================+=============+===========+		Schema URI: urn:ietf:params:scim:schemas:core:2.0:Device
	| Schema URI | Name | Reference |		Name: Core Device Schema
	+====================================+=============+===========+		Reference: RFC 9944, Section 3
	| urn:ietf:params:scim:schemas:core: | Core Device | RFC 9944, |
	| 2.0:Device | Schema | Section 3 |
	+------------------------------------+-------------+-----------+
	| urn:ietf:params:scim:schemas:core: | Endpoint | RFC 9944, |
	| 2.0:EndpointApp | Application | Section 6 |
	+------------------------------------+-------------+-----------+
	Table 9		Schema URI: urn:ietf:params:scim:schemas:core:2.0:EndpointApp
			Name: Endpoint Application
			Reference: RFC 9944, Section 6
	9.2. Device Schema Extensions		9.2. Device Schema Extensions
	IANA has created the following extensions in the "SCIM Server-Related		IANA has created the following extensions in the "SCIM Server-Related
	Schema URIs" registry as described in Section 7:		Schema URIs" registry as described in Section 7:
	+================================+=============+========+=========+		Schema URI: urn:ietf:params:scim:schemas:extension:ble:2.0:Device
	| Schema URI | Description |Resource|Reference|		Description: BLE Extension
	| | |Type | |		Resource Type: Device
	+================================+=============+========+=========+		Reference: RFC 9944, Section 7.1
	| urn:ietf:params:scim: | BLE |Device |RFC 9944,|
	| schemas:extension: | Extension | |Section |
	| ble:2.0:Device | | |7.1 |
	+--------------------------------+-------------+--------+---------+
	| urn:ietf:params:scim: | Ethernet |Device |RFC 9944,|
	| schemas:extension: ethernet- | MAB | |Section |
	| mab:2.0:Device | | |7.3 |
	+--------------------------------+-------------+--------+---------+
	| urn:ietf:params:scim: | FIDO Device |Device |RFC 9944,|
	| schemas:extension: fido- | Onboard | |Section |
	| device-onboard:2.0:Device | | |7.4 |
	+--------------------------------+-------------+--------+---------+
	| urn:ietf:params:scim: | Wi-Fi Easy |Device |RFC 9944,|
	| schemas:extension: | Connect | |Section |
	| dpp:2.0:Device | | |7.2 |
	+--------------------------------+-------------+--------+---------+
	| urn:ietf:params:scim: | Application |Device |RFC 9944,|
	| schemas:extension: | Endpoint | |Section |
	| endpointAppsExt:2.0:Device | Extension | |7.1.3 |
	+--------------------------------+-------------+--------+---------+
	| urn:ietf:params:scim: | Just Works |Device |RFC 9944,|
	| schemas:extension: | Auth BLE | |Section |
	| pairingJustWorks:2.0:Device | | |7.1.3 |
	+--------------------------------+-------------+--------+---------+
	| urn:ietf:params:scim: | Out-of-Band |Device |RFC 9944,|
	| schemas:extension: | Pairing for | |Section |
	| pairingOOB:2.0:Device | BLE | |7.1.3 |
	+--------------------------------+-------------+--------+---------+
	| urn:ietf:params:scim: | Passkey |Device |RFC 9944,|
	| schemas:extension: | Pairing for | |Section |
	| pairingPassKey:2.0:Device | BLE | |7.1.3 |
	+--------------------------------+-------------+--------+---------+
	Table 10		Schema URI:
			urn:ietf:params:scim:schemas:extension:ethernet-mab:2.0:Device
			Description: Ethernet MAB
			Resource Type: Device
			Reference: RFC 9944, Section 7.3
			Schema URI:
			urn:ietf:params:scim:schemas:extension:fido-device-
			onboard:2.0:Device
			Description: FIDO Device Onboard
			Resource Type: Device
			Reference: RFC 9944, Section 7.4
			Schema URI: urn:ietf:params:scim:schemas:extension:dpp:2.0:Device
			Description: Wi-Fi Easy Connect
			Resource Type: Device
			Reference: RFC 9944, Section 7.2
			Schema URI:
			urn:ietf:params:scim:schemas:extension:endpointAppsExt:2.0:Device
			Description: Application Endpoint Extension
			Resource Type: Device
			Reference: RFC 9944, Section 7.1.3
			Schema URI:
			urn:ietf:params:scim:schemas:extension:pairingJustWorks:2.0:Device
			Description: Just Works Auth BLE
			Resource Type: Device
			Reference: RFC 9944, Section 7.1.3
			Schema URI:
			urn:ietf:params:scim:schemas:extension:pairingOOB:2.0:Device
			Description: Out-of-Band Pairing for BLE
			Resource Type: Device
			Reference: RFC 9944, Section 7.1.3
			Schema URI:
			urn:ietf:params:scim:schemas:extension:pairingPassKey:2.0:Device
			Description: Passkey Pairing for BLE
			Resource Type: Device
			Reference: RFC 9944, Section 7.1.3
	10. References		10. References
	10.1. Normative References		10.1. Normative References
	[BLE54] Bluetooth SIG, "Bluetooth Core Specification", Version		[BLE54] Bluetooth SIG, "Bluetooth Core Specification", Version
	5.4, 2023, <https://www.bluetooth.org/DocMan/handlers/		5.4, 2023, <https://www.bluetooth.org/DocMan/handlers/
	DownloadDoc.ashx?doc_id=587177>.		DownloadDoc.ashx?doc_id=587177>.
	[DPP2] Wi-Fi Alliance, "Wi-Fi Easy Connect Specification",		[DPP2] Wi-Fi Alliance, "Wi-Fi Easy Connect Specification",
	Version 2.0, 2020.		Version 3.0, 2020, <https://www.wi-fi.org/system/files/Wi-
			Fi_Easy_Connect_Specification_v3.0.pdf>.
	[ECMA] ECMA International, "ECMAScript(R) 2025 Language		[ECMA] ECMA International, "ECMAScript(R) 2025 Language
	Specification", ECMA-262, 16th Edition, June 2025,		Specification", ECMA-262, 16th Edition, June 2025,
	<https://ecma-international.org/publications-and-		<https://ecma-international.org/publications-and-
	standards/standards/ecma-262/>.		standards/standards/ecma-262/>.
	[FDO11] FIDO Alliance, "FIDO Device Onboard Specification 1.1",		[FDO11] FIDO Alliance, "FIDO Device Onboard Specification 1.1",
	Proposed Standard, April 2022,		Proposed Standard, April 2022,
	<https://fidoalliance.org/specs/FDO/FIDO-Device-Onboard-		<https://fidoalliance.org/specs/FDO/FIDO-Device-Onboard-
	PS-v1.1-20220419/FIDO-Device-Onboard-PS-		PS-v1.1-20220419/FIDO-Device-Onboard-PS-
	skipping to change at line 1624 ¶		skipping to change at line 1628 ¶
	"multiValued": true,		"multiValued": true,
	"description": "A list of groups to which the device belongs, \		"description": "A list of groups to which the device belongs, \
	either through direct membership, through nested groups, or \		either through direct membership, through nested groups, or \
	dynamically calculated.",		dynamically calculated.",
	"required": false,		"required": false,
	"subAttributes": [		"subAttributes": [
	{		{
	"name": "value",		"name": "value",
	"type": "string",		"type": "string",
	"multiValued": false,		"multiValued": false,
	"description": "The identifier of the Device's group.",		"description": "The identifier of the device's group.",
	"required": false,		"required": false,
	"caseExact": false,		"caseExact": false,
	"mutability": "readOnly",		"mutability": "readOnly",
	"returned": "default",		"returned": "default",
	"uniqueness": "none"		"uniqueness": "none"
	},		},
	{		{
	"name": "$ref",		"name": "$ref",
	"type": "reference",		"type": "reference",
	"referenceTypes": [		"referenceTypes": [
	skipping to change at line 1735 ¶		skipping to change at line 1739 ¶
	"required": false,		"required": false,
	"caseExact": false,		"caseExact": false,
	"mutability": "readWrite",		"mutability": "readWrite",
	"returned": "default",		"returned": "default",
	"uniqueness": "none",		"uniqueness": "none",
	"subAttributes" : [		"subAttributes" : [
	{		{
	"name" : "rootCA",		"name" : "rootCA",
	"type" : "string",		"type" : "string",
	"description" : "The base64 encoding of the DER encoding \		"description" : "The base64 encoding of the DER encoding \
	of the CA certificate.",		of the CA certificate.",
	"multiValued" : false,		"multiValued" : false,
	"required" : false,		"required" : false,
	"caseExact" : true,		"caseExact" : true,
	"mutability" : "readWrite",		"mutability" : "readWrite",
	"returned" : "default",		"returned" : "default",
	"uniqueness" : "none"		"uniqueness" : "none"
	},		},
	{		{
	"name" : "subjectName",		"name" : "subjectName",
	"type" : "string",		"type" : "string",
	"description" : "A Common Name (CN) of the form of CN = \		"description" : "A Common Name (CN) of the form of CN = \
	dnsName.",		dnsName.",
	"multiValued" : false,		"multiValued" : false,
	"required" : true,		"required" : true,
	"caseExact" : true,		"caseExact" : true,
	"mutability" : "readWrite",		"mutability" : "readWrite",
	"returned" : "default",		"returned" : "default",
	"uniqueness" : "none"		"uniqueness" : "none"
	}		}
	]		]
	},		},
	{		{
	skipping to change at line 1911 ¶		skipping to change at line 1915 ¶
	"multiValued": true,		"multiValued": true,
	"required": false,		"required": false,
	"caseExact": false,		"caseExact": false,
	"mutability": "readWrite",		"mutability": "readWrite",
	"returned": "default",		"returned": "default",
	"uniqueness": "none"		"uniqueness": "none"
	},		},
	{		{
	"name": "irk",		"name": "irk",
	"type": "string",		"type": "string",
	"description": "Identity Resolving Key (IRK), which is unique \		"description": "Identity Resolving Key (IRK), which is \
	for every device. It is used to resolve a random address. This value \		unique for every device. It is used to resolve a random address. \
	MUST NOT be set when separateBroadcastAddress is set.",		This value MUST NOT be set when separateBroadcastAddress is set.",
	"multiValued": false,		"multiValued": false,
	"required": false,		"required": false,
	"caseExact": false,		"caseExact": false,
	"mutability": "readWrite",		"mutability": "readWrite",
	"returned": "default",		"returned": "default",
	"uniqueness": "Manufacturer"		"uniqueness": "Manufacturer"
	},		},
	{		{
	"name": "mobility",		"name": "mobility",
	"type": "bool",		"type": "bool",
	skipping to change at line 2074 ¶		skipping to change at line 2078 ¶
	}		}
	]		]
	<CODE ENDS>		<CODE ENDS>
	A.5. DPP Extension Schema		A.5. DPP Extension Schema
	<CODE BEGINS>		<CODE BEGINS>
	{		{
	"id": "urn:ietf:params:scim:schemas:extension:dpp:2.0:Device",		"id": "urn:ietf:params:scim:schemas:extension:dpp:2.0:Device",
	"name": "dppExtension",		"name": "dppExtension",
	"description": "Device extension schema for Wi-Fi Easy Connect \		"description": "Device extension schema for Wi-Fi Easy \
	/ Device Provisioning Protocol (DPP).",		Connect / Device Provisioning Protocol (DPP).",
	"attributes" : [		"attributes" : [
	{		{
	"name": "dppVersion",		"name": "dppVersion",
	"type": "integer",		"type": "integer",
	"description": "Version of DPP this device supports.",		"description": "Version of DPP this device supports.",
	"multiValued": false,		"multiValued": false,
	"required": true,		"required": true,
	"caseExact": false,		"caseExact": false,
	"mutability": "readWrite",		"mutability": "readWrite",
	"returned": "default",		"returned": "default",
	"uniqueness": "none"		"uniqueness": "none"
	},		},
	{		{
	"name": "bootstrappingMethod",		"name": "bootstrappingMethod",
	"type": "string",		"type": "string",
	"description": "The list of all the bootstrapping methods \		"description": "The list of all the bootstrapping methods \
	available on the enrollee device, for example, [QR, NFC].",		available on the enrollee device, for example, [QR, NFC].",
	"multiValued": true,		"multiValued": true,
	"required": false,		"required": false,
	"caseExact": false,		"caseExact": false,
	"mutability": "readWrite",		"mutability": "readWrite",
	"returned": "default",		"returned": "default",
	"uniqueness": "none"		"uniqueness": "none"
	},		},
	{		{
	"name": "bootstrapKey",		"name": "bootstrapKey",
	"type": "string",		"type": "string",
	skipping to change at line 2246 ¶		skipping to change at line 2250 ¶
	"required": true,		"required": true,
	"caseExact": false,		"caseExact": false,
	"mutability": "readWrite",		"mutability": "readWrite",
	"returned": "default",		"returned": "default",
	"uniqueness": "none"		"uniqueness": "none"
	},		},
	{		{
	"name": "deviceEui64Address",		"name": "deviceEui64Address",
	"type": "string",		"type": "string",
	"pattern": "^[0-9A-Fa-f]{2}(:[0-9A-Fa-f]{2}){7}$",		"pattern": "^[0-9A-Fa-f]{2}(:[0-9A-Fa-f]{2}){7}$",
	"description": "The 64-bit Extended Unique Identifier (EUI-64) \		"description": "The 64-bit Extended Unique Identifier \
	device address.",		(EUI-64) device address.",
	"multiValued": false,		"multiValued": false,
	"required": true,		"required": true,
	"caseExact": false,		"caseExact": false,
	"mutability": "readWrite",		"mutability": "readWrite",
	"returned": "default",		"returned": "default",
	"uniqueness": "none"		"uniqueness": "none"
	}		}
	],		],
	"meta" : {		"meta" : {
	"resourceType" : "Schema",		"resourceType" : "Schema",
	skipping to change at line 3139 ¶		skipping to change at line 3143 ¶
	| | | |		| | | |
	| | 6 200 "ok" |		| | 6 200 "ok" |
	| |<-------------------------------|		| |<-------------------------------|
	| | | |		| | | |
	| 7 200 "ok" | | |		| 7 200 "ok" | | |
	|<---------------------| | |		|<---------------------| | |
	| | | |		| | | |
	| | | |		| | | |
	After this flow is complete, the device can then first provisionally		After this flow is complete, the device can then first provisionally
	onboard and then later receive a trust anchor through FDO's TO2		onboard and then later receive a trust anchor through FDO's Transfer
	process. This is shown below.		Ownership Protocol 2 (TO2) process. This is shown below.
	,-------. ,------.		,-------. ,------.
	|Owner | ,---. |Access| ,------.		|Owner | ,---. |Access| ,------.
	|Service| |AAA| |Point | |Device|		|Service| |AAA| |Point | |Device|
	`---+---' `-+-' `---+--' `---+--'		`---+---' `-+-' `---+--' `---+--'
	| | | ,------------------!.		| | | ,------------------!.
	| | | |Device configured |_\		| | | |Device configured |_\
	| | | |with well-known |		| | | |with well-known |
	| | | |RCOI and for trust |		| | | |RCOI and for trust |
	| | | |on first use |		| | | |on first use |
End of changes. 44 change blocks.
	144 lines changed or deleted		148 lines changed or added
This html diff was produced by rfcdiff 1.48.