This page must be considered part of the iSHARE Framework
This page is considered normative and is therefore compliant with RFC 2119.
The /capabilities endpoint is required for every participant that provides services:
Participant Registry
Authorisation Registry
Service Provider
Identity Provider
The endpoint returns iSHARE capabilities of the iSHARE party. The server response is an iSHARE signed JSON Web Token.
Depending on whether or not an Access Token is provided to the capabilities endpoint, the endpoint must return public or public and restricted endpoints. in detail:
If an access token IS NOT provided
Return public endpoints, including the Access Token endpoint
If an access token IS provided
Return public endpoints, including the Access Token endpoint
Return restricted endpoints
Any endpoints that do not support the iSHARE's Identification, Authentication, and Authorization (IAA) methods and are not intended for use by iSHARE roles should not be included in the capabilities endpoint response. This is because when a participant sees an endpoint in the capabilities response, they will assume it is iSHARE-compliant and supports iSHARE’s IAA mechanisms. However, if a party has other endpoints that rely on different authorization methods and are not aligned with iSHARE, those should be excluded from the response to prevent misunderstandings.
Response Model
The model of the capabilities_token JWT response is available on Swaggerhub. For convenience the model of the parties_info object, contained within the token, is described below:
Decoded capabilities_token parameters:
It contains iSHARE compliant JWT claims, however if an access token is not provided, then aud claim should be omitted while signing JWT. In addition to that it also contains the following parameters:
capabilities_infoObject. Root level.
Contains information about capabilities.
publicServicesArray of objects. Contained in capabilities_info.
When no Authorization header is presented when invoking the /capabilities endpoint, only public_services are returned. Public_services themselves may (and usually will) require authentication to invoke them.
identifierString. Contained in public_services.
Unique identifier of the service. For iSHARE defined services, it must contain the predefined identifier (defined as operationId in the iSHARE generic OpenAPI specification). For other services, it might for instance refer operationId in OpenAPI specifications, or other forms of identifiers in other specification formats.
titleString. Contained in public_services.
Human readable name of the service.
descriptionString. Contained in public_services.
Description of the service.
descriptionURLString. Contained in public_services.
URL that provides a description of the service endpoint. Could be for instance a URL to an OpenAPI description, a WSDL document, a a SPARQL Service Description, a DCAT Data Catalog, etc.
endpointURLString. Contained in public_services.
URL of the endpoint, including the correct host. Depending on the setup, this information could also already be included in the description that is provided via the description_url.
tokenEndpointString. Contained in public_services.
URL where access token for the feature can be retrieved. This is optional because if feature is access token, it is not needed to mention it twice.
statusString. Contained in public_services.
Provides information on the status of the service. Must be either "deprecated" or "active".
serviceTypeString. Contained in public_services.
Can be either "framework-defined", "dataspace-defined" or "self-defined". A framework-defined service is required from a framework perspective (including for instance the /capabilities endpoint), a dataspace-defined service is required from a dataspace perspective and a self-defined service is define by the provider of the service (actual data services are part of this category).
versionObject. Contained in public_services.
Versioning information of the provided service.
compliesWithFrameworkVersionsArray of strings. Contained in version.
Array of framework versions that the service complies with, at a framework level. If not included, the service is assumed to be compliant with the latest version. The versions can be retrieved using the /versions endpoint. Required for framework-defined services.
compliesWithDataspaceVersionsArray of strings. Contained in version.
Array of dataspace versions that the service complies with, at a dataspace level.
capabilityVersionArray of strings. Contained in version.
Version of the provided service. The version numbering of services is not related to the version numbering of the framework or of a dataspace.
methodsArray of strings. Contained in public_services.
Array of operations supported by the endpoint. It could be HTTP methods when the endpoint is HTTP based, for example: GET, POST, etc.
restrictedServices
Array of objects. Contained in capabilities_info.
When an Authorization header is presented when invoking the /capabilities endpoint, in addition to the public services, restricted services may be returned, based on the information provided on the participant by the Authorization header. This could for example be implemented to expose services only to participants of a dataspaces. restrictedServices themselves may (and usually will) require authentication to invoke them. The attributes of restrictedServices are 100% equal to the attributes of publicServices and therefor omitted here.
Example request
> Authorization: Bearer IIeDIrdnYo2ngwDQYJKoZIhvcNAQELBQAwSDEZMBcGA1UEAwwQaVNIQ
GET /capabilities
Example response
The response contains an encoded JWT, which looks like this:
The /capabilities endpoint is required for every participant that provides services. The endpoint returns iSHARE capabilities (supported versions & optional features) of the iSHARE party.
The capabilities endpoint should only return the public endpoints if no access token is provided. If an access token is provided, the capabilities endpoint will also provide the restricted endpoints. A party may also have private endpoints, which are endpoints for their own internal organization, also known as endpoints that are implemented, but not to share with the others. These endpoints are not within the scope of iSHARE and should not be returned to other iSHARE parties.
Server response is an iSHARE signed JSON Web Token. Please refer to the models 'jwt_header' and 'jwt_payload_capabilities_token' which indicate what the decoded response will look like.