CPS-1992: NCMP to Support new ProvMnS 3GPP sync single FDN request

API as defined in and already standardised see link TS28532_ProvMnS.yaml · REL-18 · All Groups / 5G APIs · GitLab

Approved version of document https://www.3gpp.org/ftp/Specs/archive/28_series/28.532/28532-i60.zip

Feb 18, 2025 @Csaba Kocsis

Extending the current 3PP API is out of scope for this epic

As agreed. Go with the current 3GPP standard as of Feb 18, 2025

Feb 18, 2025 @Csaba Kocsis

FDN is DN

Is fully distinguished name same as distinguished name, TBD @Csaba Kocsis

DN is usually separated into local DN (managed element) and DN prefix (sub-network) both together is FDN

Sep 5, 2025 @Csaba Kocsis

Do we have to do anything about the callbacks that is specified in the ProvMns openapi spec file.

Out of scope

Feb 20, 2025 @Csaba Kocsis

Use restful solution see:https://www.etsi.org/deliver/etsi_ts/128500_128599/128532/18.05.00_60/ts_128532v180500p.pdf

See section 12.1.1 RESTful HTTP-based solution set

AgreedMar 25, 2025 @Csaba Kocsis

All registered alternate ids (FDNs) start with a '/'

@Csaba Kocsis

Question: can this interface be delivered as a separate OpenAPI definition?

Kieran Mccarthy A  asked if it could be developed separately from NCMP OpenApi definition files

Feb 18, 2025

1. Separate artifact

2. This will lead to some duplication

@Csaba Kocsis

Nov 25, 2025 @Toine Siebelink No longer relevant as we import 3GPP definition

When delivered, this should also support PolicyExecution (coordination management) for all write operations

CPS-2249: NCMP To support Conflict Handling (Policy Execution) using External Service - ONAP Wiki - Confluence point #6

@Csaba Kocsis
Nov 25, 2025 Policy Executor Integration is now a fact, see Requirement #4

Support DataProducerId changes during update for the /v1/ch and that too for the existing endpoint.

supported from blank( not defined) to some value → similar to alternate id concept.

Feb 20, 2025 @Csaba Kocsis

NCMP to update the existing endpoints
OR
NCMP to expose separate endpoints which are compliant with 3GPP standards as provided https://forge.3gpp.org/rep/all/5G_APIs/-/blob/REL-18/TS28532_ProvMnS.yaml

Analysis on existing and 3gpp endpoints below.

Mar 25, 2025 @Csaba Kocsis New 3GPP endpoints

Do we support all the Content Type that is mentioned in the openapi specs file ? Eg : application/merge-patch+json , application/3gpp-merge-patch+json , application/json-patch+json , application/3gpp-json-patch+json

AP @Csaba Kocsis what all content type will be supported in the new 3GPP endpoints.

May 20, 2025 can the content Types only be limited to @Kolawole Adebisi-Adeolokun

@Csaba Kocsis API cannot be changed (legally) so cannot add anything.

We will only support

1. application/json-patch+json

2. application/3gpp-json-patch+jso

Will return ‘not implemented’ on types we do not (want to) support

Nov 13, 2025 @csaba Eder questions if get should support application/vnd.3gpp.object-tree-hierarchical+json

Nov 24, 2025 @Csaba Kocsis application/vnd.3gpp.object-tree-hierarchical+json should be supported on GET

Do we have to sync the responses for the ProvMnS supported endpoints as mentioned in the 3gpp doc TS 128 532 ?

Documentation clear states all interaction should be synchronous see section 11.1.1.1.1: “the ‘createMOI’ response shall be returned immediately after the creation of the object.“

@Csaba Kocsis DMIs should return immediately no waiting on asynchronous processes

Comma or slash separated FDNs

% encoding does not work with / which are used in the slash FDNs.

https://lf-onap.atlassian.net/browse/CPS-2819

@Csaba Kocsis all FDN passed to the interface are using Slash-separator

Does NCMP need to prepend the DataProcuderId to the outgoing FDN (Resource Identifier)

Are we really compliant with ProvMnS if we insert this on the southbound interface

Aug 11, 2025 @Csaba Kocsis

No, is not required

{URI-LDN-first-part} is part of server url (i.e constants) not path variable so cannot be used for to store part of the target FDN

If used we would need a new server instance for each FDN

@Csaba Kocsis @Toine Siebelink @kieran mccarthy agreed not to use this at all ie leave it blank

Aug 11, 2025 @Csaba Kocsis @Toine Siebelink not used anymore.

{MnsVersion} is part of server url (i.e constants) not path variable

We can include in our URL but it means a new controller for each version but that is acceptable

Aug 11, 2025 @Csaba Kocsis

MnsVersion is included

className variable in URL Definition would have to be encoded to be able to use the Open API generated java interface

Proposed URL Structure:

{hostAddress}/ProvMnS/{MnSVersion}/{className}={id}/

Example using encoding for className
localhost:8083/ProvMnS/v1/SubNetwork%3DEurope%2FManagedElement%3DLTE01dg2ERBS00001%2FNWFunction%3Dradio%2FCell=123

If we decide NOT to encode this we need to implement manually written controllers, losing all the benefits of generated code like URL validation, query parameter extraction validation, stubs, documentation etc.

AP: Aug 11, 2025 @Seán Beirne

Create Pro/Cons list to consider with stakeholders

Options:

1. Try to fast track change in OPEN API \\ will need to pursue

2. CPS write manual controller to implement ProvMnS as was intended in documentation

3. Continue with open-api with blank URI-LDN-first-part and percent-encoded className

AP @Kolawole Adebisi-Adeolokun get sign off

Agreed to go with Option 2

CPS write manual controller to implement ProvMnS as was intended in documentation

Nov 25, 2025 @Toine Siebelink OPtions has been implemented as agreed with @Csaba Kocsis

Southbound interface; proprietary interface or ProvMNS (based) interface

ProvMnS cannot be extended to include additional data. /// Prefer similar interfaces. DMI can retrieve and/or cache the required properties itself using existing southbound interfaces.

Jul 17, 2025 @Csaba Kocsis @Kolawole Adebisi-Adeolokun
Use ProvMNS as is for SouthBound DMI Interface

Agree version number to be used for {MnsVersion}

Open API spec: v18

@Csaba Kocsis suggests:

Oran spec: v1

Nov 25, 2025 @Seán Beirne agreed v1 in call with @Csaba Kocsis some weeks back

ProvMnS Patch operations can contain 1 or more operations, should one call be made to Policy Executor or one per each operation?

Nov 24, 2025 @Csaba Kocsis Policy Executor can only accept 1 operation at the time. Requirements refinement needed , also for error handling

Nov 26, 2025 @Csaba Kocsis would like CPS_NCMP to invoke PE multiple times, cost 1-2 weeks

PatchOperation.permissionId Field for Policy Executor interface.
Is this a UUID, who populates this? Unique per Patch Operation request or same for ?

Example from @Csaba Kocsis
"permissionId": "550e8400-e29b-41d4-a716-446655440000"

Nov 26, 2025 @Csaba Kocsis

Optional parameter, not needed here (same as in existing impl)

High Cardinality in metrics for testing

unique FDNs are creating high number of metrics

Nov 26, 2025 @csaba Eder Need to improve Prometheus Logging of outgoing Request. Csabe to create a Jira under the same Epic CPS-1992 for this.

409 Conflict does NOT seem to be supported according to ETSI Spec

See https://www.etsi.org/deliver/etsi_ts/132100_132199/132158/18.02.00_60/ts_132158v180200p.pdf Table 6.6.2-1
Although 409 is mentioned in delete use case?!

Jan 7, 2026 @Csaba Kocsis

CR Pending: http://portal.3gpp.org/ngppapp/DownloadTDoc.aspx?contributionUid=SP-251403

Wil continue to use 409

Double // in FDN to DMI

Do FDN in ProvMnS requests start with / or not?

According to examples in ETSI Spec they should NOT!

(we can support the additional slash it seems ignored by controler anyway)
See org.onap.cps.ncmp.impl.provmns.ParametersBuilderSpec

Jan 6, 2026 @Toine Siebelink
It a bit confusing FDN’s should start with a ‘/' but because the UriFirstPart is a URI Path parameter the slash is/becomes the URI separator and the controller will receive a value that does NOT start with a ‘/’ In NCMP code we add the slash again to be able to look up the best match etc. We just need to make sure that on the way out to the DMI the additional '/’ is removed again.

Does patch (create, update) ops always contain (#)/attributes

Possibly not relevant, depending decision on issue ion on issue #21

No longer relevant as per decision #21

badOp casing update makes it required in generated code for ErrorResponsePatch.
Some validation errors for Patch can occur BEFORE the first operation e.g. if the main URL is invalid.
Proposal: use ErrorResponseDefault for validation errors that do not apply to one specific operation

see https://lf-onap.atlassian.net/browse/CPS-3102 for details

Jan 7, 2026 @Csaba Kocsis

 the default error response types is defined for all operations including the patch in the openapi spec, so it is ok to use that in case the error is not operation specific to confirm.

Unnecessary (double) Validation in NCMP:
Checking the format of (#)/attributes against the provided content-type is done in NCMP and in The DMI Plugins.
This seems superfluous and lead to double maintenance.
The original proposal was for ‘minimal validation’ in NCMP ie if the request is good enough to enter the java controller and we can forward it to a DMI that is good enough.

Proposal: remove the specific validation for # or not # from NCMP as introduced as part of https://lf-onap.atlassian.net/browse/CPS-3099

@Róbert Nagy Jan 6, 2026

No longer required // to do validation later.

Pass on (#)/attributes to PolicyExecutor as part of the resourceIdentifier

Currently CPS-NCMP send the complete path to PolicyExecutor.
Should #/attributes (new syntax) be remove if it is not (yet) supported?!
Should /attributes even if it is not preceded by # ?

Jan 8, 2026

@Csaba Kocsis attributes extension is NOT send to Policy, just the FDN of the PARENT of the object we are manipulating. See also #23 and #24

Should “resourceIdentifier” (as send to PolicyExecutor) be the complete FDN or be a relative path after the AlternateId of the CM Handle

extract {alternateId} from
{uri-ldn-first}/{className}={id} (finding the longest match)
rest of the {uri-ldn-first}/{className}={id} + {path-to-further-child} MINUS the last element is the resourceIdentifier
{path-to-further-child} is the path 'extension’ in patch request for each operation)

Jan 13, 2026 @Csaba Kocsis
ie or create and replace (update) operations the Alternate ID (targetIdentifier) PLUS ResourceIdentifier point to the PARENT of the MO being created or updated

This is different for remove operation issue #24

resourceIdentifier for remove (delete)

For remove there is no changeRequest with class and ID. So Alternate ID (targetIdentifier) PLUS ResourceIdentifier point to the MO being removed.
See https://lf-onap.atlassian.net/browse/CPS-3130

Jan 14, 2026 @Csaba Kocsis

Authorization for PolicExececutor

Simply forward header from ProvMnS Request (just like to DMI)
See https://lf-onap.atlassian.net/browse/CPS-3129

Jan 14, 2026 @csaba Eder

(validation) of Preceding slash in Patch.path variables.

Although not explicitly documented all (59) examples in the ETSI specification do start with a slash (#/attributes).
CPS-NCMP does not validates this and simply concatenates the two strings. If the slash is missing you get a non-existing (but still valid?) FDN which Policy Executor inadvertently might approve i.e. it does not match the blocked FDN it should.
@Csaba Kocsis suspects that downstream service might ‘insert’ the missing slash to get a valid FDN and execute the operation because Policy allowed it… This could be a security risk.

Jan 15, 2026 @Csaba Kocsis @Toine Siebelink although it is a bug on the downstream service it would be good to add validation earlier in the process. But it was agreed that it is not the role for CPS-NCMp to do this as agreed before as the general strategy that NCMP only does the minimum required as needed for functioning REST interface and forwarding the detail to Policy and correct DMI adapter.

support of someFdn/#/attributes (slash in fronr of #) instead of someFdn#/attributes

Jan 29, 2026 @Csaba Kocsis not needed to be supported (no specific validation either)

Modifying of Root Mo (ManagedElement)

@Csaba Kocsis manipulating of root MOs is no supported. Can be handled in many different ways. quick solution is for CPS-NCMP to return an error

Jan 29, 2026 Agreed option #1: CPS can do the quickest fix. Return BAD_REQUEST with type(?) VALIDATION_ERROR

CPS-E-10

Support the ProvMnS endpoint towards the Northbound API.
for create , delete , read , update and patch with Limitations (see below)

Notification support is out of scope.

Feb 20, 2025 @Csaba Kocsis

CPS-E-10

DMI plugins shall be able to indicate that they support 3GPP API.

DataproducerId to be introduced during the discovery process. When this is not blank it means ProvMnS Interface is supported

Feb 20, 2025 @Csaba Kocsis

CPS-E-10

By default NCMP shall support DMI API on its southbound interface towards the DMI plugins for CH and 3GPP Northbound APIs

@Toine Siebelink
Actually I now think I misinterpreted your wording. and I think we agree on the required default behaviour

Jul 17, 2025

@kieran mccarthy @Csaba Kocsis

Agreed to 3GPP Standard for SBI See

CPS-E-10

ProvMnS interface to support Coordination Management/Policy Execution for all write operations (just like the Legacy write interface OoS)

Although changes for the Policy Executor Interface are pending (based on 3GPP standard release 19) this will NOT be in the scope of this epic and CPS can use the existing interface as is but does need to do transformation of the incoming resource references

Jul 17, 2025

1. NCMP will receive yang-patch+json and Expected to translate to 3gpp yang-data+json. @Seán Beirne @Csaba Kocsis Agree example of the translation/transformation see: 3. Translate resource

2. TBC priority call needed on when Conflict Management can integrate their API or can NCMP use it’s current API @Peter Turcsanyi @Csaba Kocsis

3. Progress with the agreed transformation

CPS-E-10

ProvMnS interface to support Coordination Management/Policy Execution for PATCH operation by invoking PE for each individual write operation

One ‘Deny’ overrules. Whole operation cancelled.
Limit of 10 (configurable)

Nov 26, 2025 @Csaba Kocsis

TBD

DMI will need to retrieve the private (dmi) properties.

@Toine Siebelink @Csaba Kocsis Jul 17, 2025 A New Epic will created to handle these aspect

Aug 15, 2025 https://lf-onap.atlassian.net/browse/CPS-2907

CPS-E-10