Aller au contenu principal

7. SCIM Device Extensions

Cette section conserve le texte RFC des SCIM device schema extensions, y compris Device and EndpointApp resource types, BLE, DPP, Ethernet MAB, FDO, Zigbee, endpointAppsExt, JSON Schema, OpenAPI, IANA registrations et security considerations.

7.  SCIM Device Extensions

   SCIM provides various extension schemas and their attributes, along
   with JSON representations and example objects.  The core schema is
   extended with a new resource type, Device.  No schemaExtensions list
   is specified in that definition.  Instead, IANA registry entries have
   been created, where all values for "required" are set to false.  All
   extensions to the device schema MUST be registered via IANA, as
   described in Section 9.2.  The schemas below demonstrate how this
   model is to work.  All the SCIM server-related schema URIs are valid
   only with Device resource types.

7.1.  Bluetooth Low Energy (BLE) Extension

   This schema extends the device schema to represent the devices
   supporting BLE.  The extension is identified using the following
   schema URI:

   urn:ietf:params:scim:schemas:extension:ble:2.0:Device

   The attributes are as follows.

7.1.1.  Singular Attributes

   deviceMacAddress:  A string value that represents a public MAC
      address assigned by the manufacturer.  It is a unique 48-bit
      value.  It is required, case insensitive, mutable, and returned by
      default.  The ECMA regular expression pattern [ECMA] is the
      following:

      ^[0-9A-Fa-f]{2}(:[0-9A-Fa-f]{2}){5}$

   isRandom:  A boolean flag.  If false, the device is using a public
      MAC address.  If true, the device uses a random address.  If an
      Identifying Resolving Key (IRK) is present, the address represents
      a resolvable private address.  Otherwise, the address is assumed
      to be a random static address.  Non-resolvable private addresses
      are not supported by this specification.  This attribute is not
      required.  It is mutable and is returned by default.  The default
      value is false.  See Volume 6, Part B, Section 1.3 of [BLE54] for
      more information about different address types.

   separateBroadcastAddress:  When present, this string represents an
      address used for broadcasts/advertisements.  This value MUST NOT
      be set when an IRK is provided.  Its form is the same as
      deviceMacAddress.  It is not required.  It is multivalued,
      mutable, and returned by default.

   irk:  A string value that specifies the IRK, which is unique to each
      device.  It is used to resolve a private random address.  It
      should only be provisioned when isRandom is true.  It is mutable
      and never returned.  For more information about the use of the
      IRK, see Volume 1, Part A, Section 5.4.5 of [BLE54].

   mobility:  A boolean attribute to enable BLE device mobility.  If set
      to true, the device could be expected to move within a network of
      Access Points (APs).  For example, if a BLE device is connected
      with AP-1 and moves out of range but comes in range of AP-2, it
      will be disconnected with AP-1 and connected with AP-2.  It is
      returned by default and mutable.

7.1.2.  Multivalued Attributes

   versionSupport:  A multivalued set of strings that specifies the BLE
      versions supported by the device in the form of an array, for
      example, ["4.1", "4.2", "5.0", "5.1", "5.2", "5.3", "5.4"].  It is
      required, mutable, and returned by default.

   pairingMethods:  A multivalued set of strings that specifies pairing
      methods associated with the BLE device.  The pairing methods may
      require subattributes such as key/password for the device pairing
      process.  To enable the scalability of pairing methods in the
      future, they are represented as extensions to incorporate various
      attributes that are part of the respective pairing process.
      Pairing method extensions are nested inside the BLE extension.  It
      is required, case sensitive, mutable, and returned by default.

7.1.3.  BLE Pairing Method Extensions

   The details on pairing methods and their associated attributes are in
   Volume 1, Part A, Section 5.2.4 of [BLE54].  This memo defines
   extensions for four pairing methods that are nested inside the BLE
   extension schema.  Each extension contains the common attributes in
   Section 2.1.  These extensions are as follows:

   pairingNull extension:  Identified using the following schema URI:

      urn:ietf:params:scim:schemas:extension:pairingNull:2.0:Device

      pairingNull does not have any attribute.  It allows pairing for
      BLE devices that do not require a pairing method.

   pairingJustWorks extension:  Identified using the following schema
      URI:

      urn:ietf:params:scim:schemas:extension:pairingJustWorks:2.0:Device

      The Just Works pairing method does not require a key to pair
      devices.  For completeness, the key attribute is included and is
      set to 'null'.  The key attribute is required, immutable, and
      returned by default.

   pairingPassKey extension:  Identified using the following schema URI:

      urn:ietf:params:scim:schemas:extension:pairingPassKey:2.0:Device

      The passkey pairing method requires a 6-digit key to pair devices.
      This extension has one singular integer attribute, "key", which is
      required, mutable, and returned by default.  The key pattern is as
      follows:

      ^[0-9]{6}$

   pairingOOB extension:  Identified using the following schema URI:

      urn:ietf:params:scim:schemas:extension:pairingOOB:2.0:Device

      The out-of-band (OOB) pairing method includes three singular
      attributes: key, randomNumber, and confirmationNumber.

      key:
         A string value that is required and received from out-of-band
         sources such as Near Field Communication (NFC).  It is case
         sensitive, mutable, and returned by default.

      randomNumber:
         An integer that represents a nonce added to the key.  It is a
         required attribute.  It is mutable and returned by default.

      confirmationNumber:
         An integer that some solutions require in a RESTful message
         exchange (where RESTful refers to the Representational State
         Transfer (REST) architecture).  It is not required.  It is
         mutable and returned by default if it exists.

   +==================+=======+===+=======+=========+========+========+
   | Attribute        | Multi |Req| Case  | Mutable | Return | Unique |
   |                  | Value |   | Exact |         |        |        |
   +==================+=======+===+=======+=========+========+========+
   | deviceMacAddress | F     |T  | F     | RW      | Def    | Manuf  |
   +------------------+-------+---+-------+---------+--------+--------+
   | isRandom         | F     |F  | F     | RW      | Def    | None   |
   +------------------+-------+---+-------+---------+--------+--------+
   | sepBroadcastAdd  | T     |F  | F     | RW      | Def    | None   |
   +------------------+-------+---+-------+---------+--------+--------+
   | irk              | F     |F  | F     | WO      | Nev    | Manuf  |
   +------------------+-------+---+-------+---------+--------+--------+
   | versionSupport   | T     |T  | F     | RW      | Def    | None   |
   +------------------+-------+---+-------+---------+--------+--------+
   | mobility         | F     |F  | F     | RW      | Def    | None   |
   +------------------+-------+---+-------+---------+--------+--------+
   | pairingMethods   | T     |T  | T     | RW      | Def    | None   |
   +------------------+-------+---+-------+---------+--------+--------+

       Table 3: Characteristics of BLE Extension Schema Attributes

   Legend:  sepBroadcastAdd = separateBroadcastAddress, Req = Required,
            T = True, F = False, RW = ReadWrite, WO = WriteOnly,
            Def = Default, Nev = Never, Manuf = Manufacturer

   Example:

   <CODE BEGINS>
   {
     "schemas": ["urn:ietf:params:scim:schemas:core:2.0:Device",
        "urn:ietf:params:scim:schemas:extension:ble:2.0:Device"],

     "id": "e9e30dba-f08f-4109-8486-d5c6a3316111",
     "displayName": "BLE Heart Monitor",
     "active": true,
     "urn:ietf:params:scim:schemas:extension:ble:2.0:Device" : {
       "versionSupport": ["5.4"],
       "deviceMacAddress": "2C:54:91:88:C9:E2",
       "isRandom": false,
       "separateBroadcastAddress": ["AA:BB:88:77:22:11", "AA:BB:88:77:\
                                                               22:12"],
       "mobility": true,
       "pairingMethods": ["urn:ietf:params:scim:schemas:extension:\
                                            pairingPassKey:2.0:Device"],
       "urn:ietf:params:scim:schemas:extension:pairingPassKey:2.0:\
                                                             Device" : {
         "key": 123456
       }
     },
     "meta": {
       "resourceType": "Device",
         "created": "2022-01-23T04:56:22Z",
       "lastModified": "2022-05-13T04:42:34Z",
       "version": "W\/\"a330bc54f0671c9\"",
       "location": "https://example.com/v2/Devices/e9e30dba-f08f-4109-\
                                                      8486-d5c6a3316111"
     }
   }
   <CODE ENDS>

                           Figure 5: BLE Example

   In the above example, the pairing method is "pairingPassKey", which
   implies that this BLE device pairs using only a passkey.  In another
   example below, the pairing method is "pairingOOB", denoting that this
   BLE device uses the out-of-band pairing method.

   Example:

   <CODE BEGINS>
   {
     "schemas": ["urn:ietf:params:scim:schemas:core:2.0:Device",
        "urn:ietf:params:scim:schemas:extension:ble:2.0:Device"],

     "id": "e9e30dba-f08f-4109-8486-d5c6a3316111",
     "displayName": "BLE Heart Monitor",
     "active": true,
     "urn:ietf:params:scim:schemas:extension:ble:2.0:Device" : {
       "versionSupport": ["5.4"],
       "deviceMacAddress": "2C:54:91:88:C9:E2",
       "isRandom": false,
       "separateBroadcastAddress": ["AA:BB:88:77:22:11", "AA:BB:88:77:\
                                                               22:12"],
       "mobility": true,
       "pairingMethods": ["urn:ietf:params:scim:schemas:extension:\
                                                pairingOOB:2.0:Device"],
       "urn:ietf:params:scim:schemas:extension:pairingOOB:2.0:Device": {
         "key": "TheKeyvalueRetrievedFromOOB",
         "randomNumber": 238796813516896
       }
     },
     "meta": {
       "resourceType": "Device",
         "created": "2022-01-23T04:56:22Z",
       "lastModified": "2022-05-13T04:42:34Z",
       "version": "W\/\"a330bc54f0671c9\"",
       "location": "https://example.com/v2/Devices/e9e30dba-f08f-4109-\
                                                      8486-d5c6a3316111"
     }
   }
   <CODE ENDS>

                       Figure 6: BLE with pairingOOB

   However, a device can have more than one pairing method.  Support for
   multiple pairing methods is also provided by the multivalued
   attribute pairingMethods.  In the example below, the BLE device can
   pair with both passkey and OOB pairing methods.

   Example:

   <CODE BEGINS>
   {
     "schemas": ["urn:ietf:params:scim:schemas:core:2.0:Device",
        "urn:ietf:params:scim:schemas:extension:ble:2.0:Device"],

     "id": "e9e30dba-f08f-4109-8486-d5c6a3316111",
     "displayName": "BLE Heart Monitor",
     "active": true,
     "urn:ietf:params:scim:schemas:extension:ble:2.0:Device" : {
       "versionSupport": ["5.4"],
       "deviceMacAddress": "2C:54:91:88:C9:E2",
       "isRandom": false,
       "separateBroadcastAddress": ["AA:BB:88:77:22:11", "AA:BB:88:77:\
                                                               22:12"],
       "mobility": true,
       "pairingMethods": ["urn:ietf:params:scim:schemas:extension:\
                                             pairingPassKey:2.0:Device",
           "urn:ietf:params:scim:schemas:extension:pairingOOB:2.0:\
                                                               Device"],
       "urn:ietf:params:scim:schemas:extension:pairingPassKey:2.0:\
                                                             Device" : {
         "key": 123456
       },
       "urn:ietf:params:scim:schemas:extension:pairingOOB:2.0:Device": {
         "key": "TheKeyvalueRetrievedFromOOB",
         "randomNumber": 238796813516896
       }
     },
     "meta": {
       "resourceType": "Device",
         "created": "2022-01-23T04:56:22Z",
       "lastModified": "2022-05-13T04:42:34Z",
       "version": "W\/\"a330bc54f0671c9\"",
       "location": "https://example.com/v2/Devices/e9e30dba-f08f-4109-\
                                                      8486-d5c6a3316111"
     }
   }
   <CODE ENDS>

              Figure 7: BLE Pairing with Both Passkey and OOB

7.2.  Wi-Fi Easy Connect Extension

   This section describes a schema that extends the device schema to
   enable Wi-Fi Easy Connect (otherwise known as Device Provisioning
   Protocol (DPP)).  Throughout this specification, we use the term
   "DPP".  The extension is identified using the following schema URI:

   urn:ietf:params:scim:schemas:extension:dpp:2.0:Device

   The attributes in this extension are adopted from [DPP2].  The
   attributes are as follows.

7.2.1.  Singular Attributes

   dppVersion:  An integer that represents the version of DPP the device
      supports.  This attribute is required, case insensitive, mutable,
      and returned by default.

   bootstrapKey:  A string value representing an Elliptic Curve Diffie-
      Hellman (ECDH) public key.  The base64-encoded lengths for P-256,
      P-384, and P-521 are 80, 96, and 120 characters.  This attribute
      is required, case sensitive, write only, and never returned.

   deviceMacAddress:  A MAC address stored as a string.  It is a unique
      48-bit value.  This attribute is optional, case insensitive,
      mutable, and returned by default.  Its form is identical to that
      of the deviceMacAddress for BLE devices.

   serialNumber:  An alphanumeric serial number stored as a string.  It
      may also be passed as bootstrapping information.  This attribute
      is optional, case insensitive, mutable, and returned by default.

7.2.2.  Multivalued Attributes

   bootstrappingMethod:  One or more strings of all the bootstrapping
      methods available on the enrollee device, for example, [QR, NFC].
      This attribute is optional, case insensitive, mutable, and
      returned by default.

   classChannel:  One or more strings representing the global operating
      class and channel shared as bootstrapping information.  It is
      formatted as class/channel, for example, ['81/1','115/36'].  This
      attribute is optional, case insensitive, mutable, and returned by
      default.

    +=====================+=====+===+=====+=========+========+========+
    | Attribute           |Multi|Req|Case | Mutable | Return | Unique |
    |                     |Value|   |Exact|         |        |        |
    +=====================+=====+===+=====+=========+========+========+
    | dppVersion          |F    |T  |F    | RW      | Def    | None   |
    +---------------------+-----+---+-----+---------+--------+--------+
    | bootstrapKey        |F    |T  |T    | WO      | Nev    | None   |
    +---------------------+-----+---+-----+---------+--------+--------+
    | deviceMacAddress    |F    |F  |F    | RW      | Def    | Manuf  |
    +---------------------+-----+---+-----+---------+--------+--------+
    | serialNumber        |F    |F  |F    | RW      | Def    | None   |
    +---------------------+-----+---+-----+---------+--------+--------+
    | bootstrappingMethod |T    |F  |F    | RW      | Def    | None   |
    +---------------------+-----+---+-----+---------+--------+--------+
    | classChannel        |T    |F  |F    | RW      | Def    | None   |
    +---------------------+-----+---+-----+---------+--------+--------+

        Table 4: Characteristics of DPP Extension Schema Attributes

   Legend:  Req = Required, T = True, F = False, RW = ReadWrite,
            WO = WriteOnly, Def = Default, Nev = Never,
            Manuf = Manufacturer

   Example:

   <CODE BEGINS>
   {
           "schemas": ["urn:ietf:params:scim:schemas:core:2.0:Device",
                    "urn:ietf:params:scim:schemas:extension:dpp:2.0:\
                                                               Device"],

           "id": "e9e30dba-f08f-4109-8486-d5c6a3316111",
           "displayName": "WiFi Heart Monitor",
           "active": true,
           "urn:ietf:params:scim:schemas:extension:dpp:2.0:Device" : {
                   "dppVersion": 2,
                   "bootstrappingMethod": ["QR"],
                   "bootstrapKey": "\
   MDkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDIgADURzxmttZoIRIPWGoQMV00XHWCAQIhXru\
                                                          VWOz0NjlkIA=",
                   "deviceMacAddress": "2C:54:91:88:C9:F2",
                   "classChannel": ["81/1", "115/36"],
                   "serialNumber": "4774LH2b4044"
           },

           "meta": {
             "resourceType": "Device",
         "created": "2022-01-23T04:56:22Z",
             "lastModified": "2022-05-13T04:42:34Z",
             "version": "W\/\"a330bc54f0671c9\"",
             "location": "https://example.com/v2/Devices/e9e30dba-f08f-\
                                                 4109-8486-d5c6a3316111"
           }
   }
   <CODE ENDS>

                           Figure 8: DPP Example

7.3.  Ethernet MAB Extension

   This extension enables a legacy means of (very) weak authentication,
   known as MAC Authenticated Bypass (MAB), that is supported in many
   wired ethernet solutions.  If the MAC address is known, then the
   device may be permitted (perhaps limited) access.  The extension is
   identified by the following URI:

   urn:ietf:params:scim:schemas:extension:ethernet-mab:2.0:Device

   Note that this method is not likely to work properly with MAC address
   randomization.

7.3.1.  Single Attribute

   This extension has a singular attribute:

   deviceMacAddress:  This is the Ethernet address to be provisioned
      onto the network.  It takes the identical form as found in the BLE
      extension.

   +==================+=======+===+=======+=========+========+========+
   | Attribute        | Multi |Req| Case  | Mutable | Return | Unique |
   |                  | Value |   | Exact |         |        |        |
   +==================+=======+===+=======+=========+========+========+
   | deviceMacAddress | F     |T  | F     | RW      | Def    | None   |
   +------------------+-------+---+-------+---------+--------+--------+

       Table 5: Characteristics of MAB Extension Schema Attributes

   Legend:  Req = Required, T = True, F = False, RW = ReadWrite,
            Def = Default

   Example:

   <CODE BEGINS>
   {
     "schemas": ["urn:ietf:params:scim:schemas:core:2.0:Device",
        "urn:ietf:params:scim:schemas:extension:ethernet-mab:2.0:Device\
                                                                     "],

     "id": "e9e30dba-f08f-4109-8486-d5c6a3316111",
     "displayName": "Some random Ethernet Device",
     "active": true,
     "urn:ietf:params:scim:schemas:extension:ethernet-mab:2.0:Device" \
                                                                     : {
       "deviceMacAddress": "2C:54:91:88:C9:E2"
     },

     "meta": {
       "resourceType": "Device",
         "created": "2022-01-23T04:56:22Z",
       "lastModified": "2022-05-13T04:42:34Z",
       "version": "W\/\"a330bc54f0671c9\"",
       "location": "https://example.com/v2/Devices/e9e30dba-f08f-4109-\
                                                      8486-d5c6a3316111"
     }
   }
   <CODE ENDS>

                           Figure 9: MAB Example

7.4.  FIDO Device Onboard Extension

   This extension specifies a voucher to be used by the FDO Device
   Onboard (FDO) protocols [FDO11] to complete a trusted transfer of
   ownership and control of the device to the environment.  The SCIM
   server MUST know how to process the voucher, either directly or by
   forwarding it along to an owner process as defined in the FDO
   specification.  The extension is identified using the following
   schema URI:

   urn:ietf:params:scim:schemas:extension:fido-device-onboard:2.0:Device

7.4.1.  Single Attribute

   This extension has a singular attribute:

   fdoVoucher:  The voucher is formatted as a PEM-encoded object in
      accordance with [FDO11].

     +============+=======+=====+=======+=========+========+========+
     | Attribute  | Multi | Req | Case  | Mutable | Return | Unique |
     |            | Value |     | Exact |         |        |        |
     +============+=======+=====+=======+=========+========+========+
     | fdoVoucher | F     | T   | F     | WO      | Nev    | None   |
     +------------+-------+-----+-------+---------+--------+--------+

       Table 6: Characteristics of FDO Extension Schema Attributes

   Legend:  Req = Required, T = True, F = False, WO = WriteOnly,
            Nev = Never

   Example:

   <CODE BEGINS>
   {
     "schemas": ["urn:ietf:params:scim:schemas:core:2.0:Device",
        "urn:ietf:params:scim:schemas:extension:fido-device-onboard:2.0\
                                                             :Device"],

     "id": "e9e30dba-f08f-4109-8486-d5c6a3316111",
     "displayName": "Some random Ethernet Device",
     "active": true,
     "urn:ietf:params:scim:schemas:extension:fido-device-onboard:2.0:\
                                                            Device" : {
        "fdoVoucher": "{... voucher ...}"
     },

     "meta": {
       "resourceType": "Device",
         "created": "2022-01-23T04:56:22Z",
       "lastModified": "2022-05-13T04:42:34Z",
       "version": "W\/\"a330bc54f0671c9\"",
       "location": "https://example.com/v2/Devices/e9e30dba-f08f-4109-\
                                                      8486-d5c6a3316111"
     }
   }
   <CODE ENDS>

                           Figure 10: FDO Example

7.5.  Zigbee Extension

   This section describes a schema that extends the device schema to
   enable the provisioning of Zigbee devices [Zigbee].  The extension is
   identified using the following schema URI:

   urn:ietf:params:scim:schemas:extension:zigbee:2.0:Device

   It has one singular attribute and one multivalued attribute.  The
   attributes are as follows.

7.5.1.  Singular Attribute

   deviceEui64Address:  A 64-bit Extended Unique Identifier (EUI-64)
      device address stored as string.  This attribute is required, case
      insensitive, mutable, and returned by default.  It takes the same
      form as the deviceMacAddress in the BLE extension.

7.5.2.  Multivalued Attribute

   versionSupport:  One or more strings of all the Zigbee versions
      supported by the device, for example, [3.0].  This attribute is
      required, case insensitive, mutable, and returned by default.

   +====================+=====+===+=======+=========+========+========+
   | Attribute          |Multi|Req| Case  | Mutable | Return | Unique |
   |                    |Value|   | Exact |         |        |        |
   +====================+=====+===+=======+=========+========+========+
   | deviceEui64Address |F    |T  | F     | RW      | Def    | None   |
   +--------------------+-----+---+-------+---------+--------+--------+
   | versionSupport     |T    |T  | F     | RW      | Def    | None   |
   +--------------------+-----+---+-------+---------+--------+--------+

      Table 7: Characteristics of Zigbee Extension Schema Attributes

   Legend:  Req = Required, T = True, F = False, RW = ReadWrite,
            Def = Default

   Example:

   <CODE BEGINS>
   {
     "schemas": ["urn:ietf:params:scim:schemas:core:2.0:Device",
        "urn:ietf:params:scim:schemas:extension:zigbee:2.0:Device"],

     "id": "e9e30dba-f08f-4109-8486-d5c6a3316111",
     "displayName": "Zigbee Heart Monitor",
     "active": true,
     "urn:ietf:params:scim:schemas:extension:zigbee:2.0:Device" : {
       "versionSupport": ["3.0"],
       "deviceEui64Address": "50:32:5F:FF:FE:E7:67:28"
     },

     "meta": {
       "resourceType": "Device",
         "created": "2022-01-23T04:56:22Z",
       "lastModified": "2022-05-13T04:42:34Z",
       "version": "W\/\"a330bc54f0671c9\"",
       "location": "https://example.com/v2/Devices/e9e30dba-f08f-4109-\
                                                      8486-d5c6a3316111"
     }
   }
   <CODE ENDS>

                         Figure 11: Zigbee Example

7.6.  The Endpoint Applications Extension Schema

   Sometimes non-IP devices such as those using BLE or Zigbee require an
   application gateway interface to manage them.

   endpointAppsExt provides the list of applications that connect to an
   enterprise gateway. endpointAppsExt has one multivalued attribute and
   two singular attributes.  The extension is identified using the
   following schema URI:

   urn:ietf:params:scim:schemas:extension:endpointAppsExt:2.0:Device

7.6.1.  Singular Attributes

   deviceControlEnterpriseEndpoint:  A string representing the URL of
      the enterprise endpoint to reach the enterprise gateway.  When the
      enterprise receives the SCIM object from the onboarding
      application, it adds this attribute to it and sends it back as a
      response to the onboarding application.  This attribute is
      required, case sensitive, read-only, and returned by default.  The
      uniqueness is enforced by the enterprise.

   telemetryEnterpriseEndpoint:  A string representing a URL of the
      enterprise endpoint to reach an enterprise gateway for telemetry.
      When the enterprise receives the SCIM object from the onboarding
      application, it adds this attribute to it and sends it back as a
      response to the onboarding application.  This attribute is
      optional, case sensitive, read-only, and returned by default.  The
      uniqueness is enforced by the enterprise.  This attribute is
      populated when the enterprise provides a telemetry endpoint (e.g.,
      hosted by the enterprise gateway).  If a telemetry service is not
      known by the SCIM server, the attribute will not be returned.  In
      such cases, if the application requires telemetry, separate
      arrangements must be made.

7.6.2.  Multivalued Attribute

   applications:  A multivalued attribute of one or more complex
      attributes that represent a list of endpoint applications, i.e.,
      deviceControl and telemetry.  Each entry in the list comprises two
      attributes including "value" and "$ref".

   value:  A string containing the identifier of the endpoint
      application formatted as a Universally Unique Identifier (UUID).
      It is the same as the common attribute "$id" of the resource
      EndpointApp.  It is read/write, required, case insensitive, and
      returned by default.

   $ref:  A reference to the respective EndpointApp resource object
      stored in the SCIM server.  It is readOnly, required, case
      sensitive, and returned by default.

   +====================+=====+===+=======+=========+========+========+
   | Attribute          |Multi|Req| Case  | Mutable | Return | Unique |
   |                    |Value|   | Exact |         |        |        |
   +====================+=====+===+=======+=========+========+========+
   | devContEntEndpoint |F    |T  | T     | RO      | Def    | Ent    |
   +--------------------+-----+---+-------+---------+--------+--------+
   | telEntEndpoint     |F    |F  | T     | RO      | Def    | Ent    |
   +--------------------+-----+---+-------+---------+--------+--------+
   | applications       |T    |T  | F     | RW      | Def    | None   |
   +--------------------+-----+---+-------+---------+--------+--------+
   | value              |F    |T  | F     | RW      | Def    | None   |
   +--------------------+-----+---+-------+---------+--------+--------+
   | $ref               |F    |T  | T     | RO      | Def    | None   |
   +--------------------+-----+---+-------+---------+--------+--------+

       Table 8: Characteristics of endpointAppsExt Extension Schema
                                Attributes

   Legend:  devContEntEndpoint = deviceControlEnterpriseEndpoint,
            telEntEndpoint = telemetryEnterpriseEndpoint,
            Req = Required, T = True, F = False, RO = ReadOnly,
            RW = ReadWrite, Ent = Enterprise, Def = Default

   Example:

   <CODE BEGINS>
   {
     "schemas": ["urn:ietf:params:scim:schemas:core:2.0:Device",
        "urn:ietf:params:scim:schemas:extension:ble:2.0:Device",
        "urn:ietf:params:scim:schemas:extension:endpointAppsExt:2.0:\
                                                               Device"],
     "id": "e9e30dba-f08f-4109-8486-d5c6a3316111",
     "displayName": "BLE Heart Monitor",
     "active": true,
     "urn:ietf:params:scim:schemas:extension:ble:2.0:Device" : {
       "versionSupport": ["5.4"],
       "deviceMacAddress": "2C:54:91:88:C9:E2",
       "isRandom": false,
       "separateBroadcastAddress": ["AA:BB:88:77:22:11", "AA:BB:88:77:\
                                                                22:12"],
       "mobility": false,
       "pairingMethods": [
           "urn:ietf:params:scim:schemas:extension:pairingPassKey:2.0:\
                                                               Device"],
       "urn:ietf:params:scim:schemas:extension:pairingPassKey:2.0:\
                                                             Device" : {
         "key": 123456
       }
     },
     "urn:ietf:params:scim:schemas:extension:endpointAppsExt:2.0:Device\
                                                                    ": {
       "applications": [
         {
           "value" : "e9e30dba-f08f-4109-8486-d5c6a3316212",
           "$ref" : "https://example.com/v2/EndpointApps/e9e30dba-f08f-\
                                                 4109-8486-d5c6a3316212"
         },
         {
           "value" : "e9e30dba-f08f-4109-8486-d5c6a3316333",
           "$ref" : "https://example.com/v2/EndpointApps/e9e30dba-f08f-\
                                                 4109-8486-d5c6a3316333"
         }
       ],
         "deviceControlEnterpriseEndpoint": "https://example.com/\
                                          device_control_app_endpoint/",
         "telemetryEnterpriseEndpoint": "mqtts://example.com/\
                                                telemetry_app_endpoint/"
     },
     "meta": {
       "resourceType": "Device",
         "created": "2022-01-23T04:56:22Z",
       "lastModified": "2022-05-13T04:42:34Z",
       "version": "W\/\"a330bc54f0671c9\"",
       "location": "https://example.com/v2/Devices/e9e30dba-f08f-4109-\
                                                      8486-d5c6a3316111"
     }
   }
   <CODE ENDS>

             Figure 12: Endpoint Applications Extension Example

   The schema for the endpointAppsExt extension along with BLE extension
   is presented in JSON format in Appendix A.9, while the OpenAPI
   representation is provided in Appendix B.8.