RFC 9944
Device Schema Extensions to the System for Cross-Domain Identity Management (SCIM) Model
Device Schema Extensions to the System for Cross-Domain Identity Management (SCIM) Model 🎀
RFC 9944 ✨ IETF (Internet Engineering Task Force), Standards Track, ISSN 2070-1721, May 2026
The authors are M. Shahzad and H. Iqbal from North Carolina State University, and E. Lear from Cisco Systems 💜
Abstract 🌸
Okay so the original SCIM core schema was built for provisioning users 👤 This memo adds schema extensions so you can provision devices too 🔥 It works with bootstrapping systems like Wi-Fi Easy Connect, FIDO device onboarding vouchers, Bluetooth Low Energy (BLE) passcodes, and MAC Authenticated Bypass (MAB) ✨
Status of This Memo 🧚
Bestie, this is an Internet Standards Track document 💅
This doc is a product of the Internet Engineering Task Force (IETF). It represents the consensus of the IETF community, got public review, and was approved for publication by the Internet Engineering Steering Group (IESG). If you want more on Internet Standards, check Section 2 of RFC 7841 🦋
For the current status, any errata, and how to send feedback, go to https://www.rfc-editor.org/info/rfc9944 💖
Copyright Notice 🎀
Copyright (c) 2026 IETF Trust and the persons identified as the document authors. All rights reserved. 🌈
This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) in effect on the date of publication. Please read these carefully, because they describe your rights and restrictions for this document 🙈 Code Components extracted from this document must include Revised BSD License text as described in Section 4.e of the Trust Legal Provisions, and they're provided without warranty as described in the Revised BSD License 🔥
Table of Contents 🍓
1. Introduction
1.1. Why SCIM for Devices?
1.2. Protocol Participants
1.3. Schema Description
1.4. Schema Representation
1.5. Terminology
2. ResourceType Device
2.1. Common Attributes
3. SCIM Core Device Schema
3.1. Singular Attributes
4. Groups
5. Resource Type EndpointApp
6. SCIM EndpointApp Schema
6.1. Common Attributes
6.2. Singular Attributes
6.3. Complex Attributes
6.3.1. certificateInfo
7. SCIM Device Extensions
7.1. Bluetooth Low Energy (BLE) Extension
7.1.1. Singular Attributes
7.1.2. Multivalued Attributes
7.1.3. BLE Pairing Method Extensions
7.2. Wi-Fi Easy Connect Extension
7.2.1. Singular Attributes
7.2.2. Multivalued Attributes
7.3. Ethernet MAB Extension
7.3.1. Single Attribute
7.4. FIDO Device Onboard Extension
7.4.1. Single Attribute
7.5. Zigbee Extension
7.5.1. Singular Attribute
7.5.2. Multivalued Attribute
7.6. The Endpoint Applications Extension Schema
7.6.1. Singular Attributes
7.6.2. Multivalued Attribute
8. Security Considerations
8.1. SCIM Operations
8.1.1. Unauthorized Object Creation
8.2. Object Deletion
8.3. Read Operations
8.4. Update Operations
8.5. Higher Level Protection for Certain Systems
8.6. Logging
9. IANA Considerations
9.1. New Schemas
9.2. Device Schema Extensions
10. References
10.1. Normative References
10.2. Informative References
Appendix A. JSON Schema Representation
A.1. Resource Schema
A.2. Core Device Schema
A.3. EndpointApp Schema
A.4. BLE Extension Schema
A.5. DPP Extension Schema
A.6. Ethernet MAB Extension Schema
A.7. FDO Extension Schema
A.8. Zigbee Extension Schema
A.9. endpointAppsExt Extension Schema
Appendix B. OpenAPI Representation
B.1. Core Device Schema OpenAPI Representation
B.2. EndpointApp Schema OpenAPI Representation
B.3. BLE Extension Schema OpenAPI Representation
B.4. DPP Extension Schema OpenAPI Representation
B.5. Ethernet MAB Extension Schema OpenAPI Representation
B.6. FDO Extension Schema OpenAPI Representation
B.7. Zigbee Extension Schema OpenAPI Representation
B.8. endpointAppsExt Extension Schema OpenAPI Representation
Appendix C. FIDO Device Onboarding Example Flow
Acknowledgments
Authors' Addresses1. Introduction 🦋
The Internet of Things is a whole management challenge, and it's giving many dimensions 😭 One big piece is being able to onboard and manage a huge number of devices. There are lots of models for bootstrapping trust between devices and network deployments, and honestly it's expected that different manufacturers will use different methods 💅
SCIM [RFC7643] [RFC7644] defines a protocol and a schema for provisioning users. BUT it can easily be extended to provision device credentials and other attributes into a network 🧚 The protocol and core schema were designed to permit exactly that kind of extension. Bulk operations are supported, and this is so good because devices are often procured in bulk 🛒
The main goal of this specification is to provision the network for onboarding and communications access to and from devices within a local deployment, based on the underlying capabilities of those devices 💖
The security mechanisms of devices range from non-existent, like the Bluetooth Low Energy (BLE) "Just Works" pairing method, all the way up to a robust FIDO Device Onboard (FDO) mechanism 🙈 Information from the SCIM server gets dispatched to control functions based on the selected schema extensions, so these communications can happen within a network ✨ Basically, the SCIM database is essentially equivalent to a network's Authentication, Authorization, and Accounting (AAA) database, so it should be carefully managed as such 🔐
1.1. Why SCIM for Devices? 🌷
There are a bunch of existing models that could be the basis for provisioning devices onto a network. Two are standardized by the IETF: NETCONF [RFC6241] or RESTCONF [RFC8040] with YANG [RFC7950]. SCIM was chosen for these reasons 💜
- NETCONF and RESTCONF focus on configuration rather than provisioning. 🛠️
- SCIM is designed with inter-domain provisioning in mind. Because it uses HTTP as a substrate, it supports both user-based authentication for local provisioning apps and OAUTH or certificate-based authentication 🔑 The inter-domain nature of these operations doesn't expose local policy. Local policy has to be configured with other APIs, and many of those aren't standardized (and often the policy really is configured that way) 🙃
- SCIM is also a familiar tool in enterprise environments, where it's used a lot to configure federated user accounts 🏢
- Finally, once you pick a vehicle like SCIM, you're beholden to its data model. The SCIM data model is more targeted to provisioning, as laid out in [RFC7643] 💅
Taken together with the fact that end devices aren't meant to be directly configured, this leaves SCIM as the best standard option 👑
1.2. Protocol Participants 🧚♀️
In the normal SCIM model, the presumption was that large federated deployments would be SCIM clients, provisioning and removing employees and contractors as they join and leave. Federated services like sales, payment, or conferencing would be the servers 💼
In the device model, the roles are flipped and can be a bit more varied 🔄 The SCIM server lives within a deployment and is used to receive information about devices that are expected to connect to its network. That server applies appropriate local policies about whether and how the device should connect 🔥
The client could be one of a few different entities:
- A vendor who's authorized to add devices to a network as part of a sales transaction. This is similar to the sales integration sometimes envisioned by Bootstrapping Remote Secure Key Infrastructure (BRSKI) [RFC8995] 🛍️
- A client app that admins or employees use to add, remove, or get info about devices. For example, a tablet or phone app that scans Wi-Fi Easy Connect QR codes 📱
Here's the non-IP picture 👀
+-----------------------------------+
| |
+-----------+ Request | +---------+ |
| Onboarding|------------->| SCIM | |
| App |<-------------| Server | |
+-----------+ Ctrl Endpt +---------+ |
| | |
| |(Device Info) |
| v |
+-----------+ | +------------+ +-------+ |
| Control |...........|..| ALG |.........|Device | |
| App | | +------------+ +-------+ |
+-----------+ | |
| Local Network |
+-----------------------------------+
Figure 1: Basic Architecture - Non-IP ExampleIn Figure 1, the onboarding app (app) provides the device particulars. These vary based on the type of device, as indicated by the selection of schema extensions 🎀 As part of the response, the SCIM server might give back additional info, especially for non-IP devices, where an application-layer gateway may need to be used to talk to the device (c.f., [NIPC]) 🧚 The control endpoint is one of several objects that may be returned. That control endpoint then communicates with the Application Layer Gateway (ALG) to reach the device 🌈
Now for IP-based endpoints 💖
+------------------------------------+
| |
+-----------+ Request | +---------+ +----+ +------+ |
| Onboarding|------------->| SCIM |-->| AAA|<-->|Switch| |
| App |<-------------| Server | +----+ +------+ |
+-----------+ Ctrl Endpt +---------+ | |
| | |
+-----------+ | +------------+ +-------+ |
| Control |...........|..| Router/fw |.........|Device | |
| App | | +------------+ +-------+ |
+-----------+ | |
| Local Network |
+------------------------------------+
Figure 2: Interaction with AAAFigure 2 shows how IP-based endpoints can be provisioned 🦋 In this case, the onboarding app provisions a device via SCIM. The necessary info is passed to the Authentication, Authorization, and Accounting (AAA) subsystem, so the device is permitted to connect. Once it's online, since the device is IP-based, it won't need an ALG. Instead it uses the normal IP infrastructure to talk to its control app 🫶
1.3. Schema Description 💅
okay so [RFC7643] doesn't give you a language for describing a schema. it just uses a narrative description with examples, and we're following that same approach ✨. we also include non-normative JSON Schemas [JSONSchema] and OpenAPI [OpenAPI] versions in the appendices to make implementing easier 🫶. neither of those existed when SCIM was first developed 🕰️. the only difference the authors noticed between the normative schema representations is that the JSON Schemas and OpenAPI versions can't express case sensitivity, so attributes that aren't case sensitive have to be checked manually 🙈.
several extra schemas cover specific onboarding mechanisms, like Bluetooth Low Energy (BLE) [BLE54], Wi-Fi Easy Connect [DPP2], and FIDO Device Onboard [FDO11] 🦋.
whenever JSON appears in this memo, it's folded in accordance with [RFC8792] 🍓.
1.4. Schema Representation 🎀
attributes in the device core schema (see Section 2.2 of [RFC7643]) and in extensions are made up of characteristics and the SCIM datatypes (defined in Section 2.3 of [RFC7643]). this specification does not define new characteristics and datatypes for the SCIM attributes 💜.
1.5. Terminology 📚
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all capitals, as shown here.
the reader is also expected to be familiar with the narrative schema language used in [RFC7643] 🧠.
2. ResourceType Device 🧚
a new resource type, Device, is specified here. the "ResourceType" schema holds the metadata about a resource type (see Section 6 of [RFC7643]). it's made up of a core device schema plus several extension schemas. the core schema gives a minimal resource representation, and the extension schemas build on it depending on the device's capability ✨.
2.1. Common Attributes
the device schema has three common attributes from Section 3.1 of [RFC7643]. no semantic or syntax changes happen here. they're only listed for completeness 💅.
- id: A required and unique attribute of the core device schema (see Section 3.1 of [RFC7643]).
- externalId: An optional attribute (see Section 3.1 of [RFC7643]).
- meta: A required and complex attribute (see Section 3.1 of [RFC7643]).
3. SCIM Core Device Schema 🌈
the core device schema is the minimal representation of a resource Device. it only includes the attributes any device might need, and only one attribute is required. it's identified by this schema URI:
urn:ietf:params:scim:schemas:core:2.0:Device
the following attributes are defined in the core device schema.
3.1. Singular Attributes
displayName: a string that gives a human-readable name for a device. it's meant to be shown to end users, so it should be suitable for that purpose 👀. the attribute isn't required and isn't case sensitive. it may be modified and SHOULD be returned by default. no uniqueness constraints are imposed on this attribute.
active: a mutable boolean that is required 🔌. if it's set to true, the device is intended to be operational. attempts to control or access a device where this value is set to false may fail. for example, when used together with Non-Internet-Connected Physical Components (NIPC) [NIPC], commands (such as connect, disconnect, and subscribe) that an application sends to the controller for devices will be rejected by the controller 🚫.
mudUrl: a string that represents the URL to the Manufacturer Usage Description (MUD) file associated with this device 📄. this attribute is optional, mutable, and returned by default. when present, it may be used as described in [RFC8520]. the mudUrl value is case sensitive and not unique.
groups: an optional read-only complex object that indicates group membership 👯. its form is precisely the same as the one defined in Section 4.1.2 of [RFC7643].
+=============+=======+=====+=======+=========+========+========+
| Attribute | Multi | Req | Case | Mutable | Return | Unique |
| | Value | | Exact | | | |
+=============+=======+=====+=======+=========+========+========+
| displayName | F | F | F | RW | Def | None |
+-------------+-------+-----+-------+---------+--------+--------+
| active | F | T | F | RW | Def | None |
+-------------+-------+-----+-------+---------+--------+--------+
| mudUrl | F | F | T | RW | Def | None |
+-------------+-------+-----+-------+---------+--------+--------+
| groups | T | F | T | RO | Def | n/a |
+-------------+-------+-----+-------+---------+--------+--------+
Table 1: Characteristics of Device Schema AttributesLegend: Req = Required, T = True, F = False, RO = ReadOnly, RW = ReadWrite, Def = Default
Example:
{
"schemas": ["urn:ietf:params:scim:schemas:core:2.0:Device"],
"id": "e9e30dba-f08f-4109-8486-d5c6a3316111",
"displayName": "BLE Heart Monitor",
"active": true,
"meta": {
"resourceType": "Device",
"created": "2022-01-23T04:56:22Z",
"lastModified": "2022-05-13T04:42:34Z",
"version": "W\/\"a330bc54f0671c9\"",
"location": "https://example.com/v2/Devices/e9e30dba-f08f-\
4109-8486-d5c6a3316111"
}
}Figure 3: Core Device Example Entries 🧁
4. Groups 🫶
device and EndpointApp groups are created using the SCIM groups defined in Section 4.2 of [RFC7643]. if set, the "type" subattribute of the "members" attribute MUST be set to Device for devices and EndpointApp for endpoint applications 💖.
5. Resource Type EndpointApp 💜
this section defines the EndpointApp resource type. the "ResourceType" schema specifies the metadata about a resource type (see Section 6 of [RFC7643]). the EndpointApp resource represents client applications that can control and/or receive data from the devices 📱.
6. SCIM EndpointApp Schema 🎀
the EndpointApp schema is used to authorize control or telemetry services for clients. it identifies the application and how clients authenticate to the various services 🔐.
the schema for EndpointApp is identified by this schema URI:
urn:ietf:params:scim:schemas:core:2.0:EndpointApp
the following attributes are defined in this schema.
6.1. Common Attributes
like Section 2.1, the EndpointApp schema has the three common attributes specified in Section 3.1 of [RFC7643] 🦋.
6.2. Singular Attributes
applicationType: a string that represents the type of application. it will only contain two values: deviceControl or telemetry 🕹️. deviceControl is the application that sends commands to control the device. telemetry is the application that receives data from the device. the attribute is required and not case sensitive. it's immutable and should be returned by default. no uniqueness constraints are imposed on this attribute.
applicationName: a string that represents a human-readable name for the application 🏷️. this attribute is required and mutable. it should be returned by default, and there's no uniqueness constraint on it.
clientToken: a string that contains a token the client uses to authenticate itself 🔑. each token may be a string up to 500 characters in length. it isn't mutable. it's read-only and case sensitive, and it's generated if no certificateInfo object is provisioned. it's returned by default if it exists. the SCIM server should expect that client tokens will be shared by the SCIM client with other components within the client's infrastructure 👀.
groups: an optional read-only complex object that indicates group membership 👯. its form is precisely the same as the one defined in Section 4.1.2 of [RFC7643].
6.3. Complex Attributes ✨
6.3.1. certificateInfo 🎀
okay so certificateInfo is a complex attribute 💖 that holds an X.509 certificate's subject name and root Certificate Authority (CA) info for the application clients that'll connect for device control or telemetry 🧚
rootCA: this is a base64-encoded string, as described in Section 4 of [RFC4648] 🍓 It's a trust anchor certificate for the certs used for client application access. The object is not required. It's singular, case sensitive, and read/write. If it isn't there, a set of trust anchors MUST be configured out of band 🔐
subjectName: a string that holds one of two names 👑
- a distinguished name that will be present in the certificate subject field, as described in Section 4.1.2.4 of [RFC5280] or
- a dnsName as part of a subjectAlternateName, as described in Section 4.2.1.6 of [RFC5280]
In the latter case, servers validating such certificates SHALL reject connections when the name of the peer as resolved by a DNS reverse lookup does not match the dnsName in the certificate. 💅 If multiple dnsNames are present, it's left to server implementations to address any authorization conflicts associated with those names. This attribute is not required and not case sensitive. It's mutable and singular ✨
+=================+=======+===+=======+=========+========+========+
| Attribute | Multi |Req| Case | Mutable | Return | Unique |
| | Value | | Exact | | | |
+=================+=======+===+=======+=========+========+========+
| applicationType | F |T | F | Imm | Def | None |
+-----------------+-------+---+-------+---------+--------+--------+
| applicationName | F |T | F | RW | Def | None |
+-----------------+-------+---+-------+---------+--------+--------+
| clientToken | F |F | T | RO | Def | None |
+-----------------+-------+---+-------+---------+--------+--------+
| certificateInfo | F |F | F | RW | Def | None |
+-----------------+-------+---+-------+---------+--------+--------+
| rootCA | F |F | T | RW | Def | None |
+-----------------+-------+---+-------+---------+--------+--------+
| subjectName | F |T | T | RW | Def | None |
+-----------------+-------+---+-------+---------+--------+--------+
| groups | T |F | T | RO | Def | n/a |
+-----------------+-------+---+-------+---------+--------+--------+
Table 2: Characteristics of EndpointApp Schema AttributesLegend: Req = Required, T = True, F = False, RO = ReadOnly, RW = ReadWrite, N = No, Def = Default, Imm = Immutable 📖
If certificateInfo is provided by the client and is accepted by the server, the server MUST return that multivalued attribute in its response. Otherwise, the server is expected to return a clientToken. If the server returns neither certificateInfo nor a clientToken, then external authentication such as [OAUTHv2] MUST be pre-arranged. If the server accepts a certificate and produces a clientToken, then control and telemetry servers MUST validate both 🫶
certificateInfo is preferred in situations where client functions are federated, so different clients may connect for different purposes 🌈
Example:
{
"schemas": ["urn:ietf:params:scim:schemas:core:2.0:EndpointApp"],
"id": "e9e30dba-f08f-4109-8486-d5c6a3316212",
"applicationType": "deviceControl",
"applicationName": "Device Control App 1",
"certificateInfo": {
"rootCA" : "MIIBIjAN...",
"subjectName": "www.example.com"
},
"meta": {
"resourceType": "EndpointApp",
"created": "2022-01-23T04:56:22Z",
"lastModified": "2022-05-13T04:42:34Z",
"version": "W\/\"a330bc54f0671c9\"",
"location": "https://example.com/v2/EndpointApps/e9e30dba-f08f-\
4109-8486-d5c6a3316212"
}
}Figure 4: Endpoint App Example 🧁
7. SCIM Device Extensions 🦋
SCIM provides various extension schemas and their attributes, along with JSON representations and example objects. The core schema is extended with a new resource type, Device. No schemaExtensions list is specified in that definition. Instead, IANA registry entries have been created, where all values for "required" are set to false. All extensions to the device schema MUST be registered via IANA, as described in Section 9.2. The schemas below demonstrate how this model is to work. All the SCIM server-related schema URIs are valid only with Device resource types 💜
7.1. Bluetooth Low Energy (BLE) Extension 📡
This schema extends the device schema to represent the devices supporting BLE. The extension is identified using the following schema URI:
urn:ietf:params:scim:schemas:extension:ble:2.0:Device
The attributes are as follows.
7.1.1. Singular Attributes ✨
deviceMacAddress: a string value that represents a public MAC address assigned by the manufacturer. It is a unique 48-bit value. It is required, case insensitive, mutable, and returned by default. The ECMA regular expression pattern [ECMA] is the following:
^[0-9A-Fa-f]{2}(:[0-9A-Fa-f]{2}){5}$isRandom: a boolean flag 🎲 If false, the device is using a public MAC address. If true, the device uses a random address. If an Identifying Resolving Key (IRK) is present, the address represents a resolvable private address. Otherwise, the address is assumed to be a random static address. Non-resolvable private addresses are not supported by this specification. This attribute is not required. It is mutable and is returned by default. The default value is false. See Volume 6, Part B, Section 1.3 of [BLE54] for more information about different address types.
separateBroadcastAddress: when present, this string represents an address used for broadcasts/advertisements 📢 This value MUST NOT be set when an IRK is provided. Its form is the same as deviceMacAddress. It is not required. It is multivalued, mutable, and returned by default.
irk: a string value that specifies the IRK, which is unique to each device 🔑 It is used to resolve a private random address. It should only be provisioned when isRandom is true. It is mutable and never returned. For more information about the use of the IRK, see Volume 1, Part A, Section 5.4.5 of [BLE54].
mobility: a boolean attribute to enable BLE device mobility 🚶♀️ If set to true, the device could be expected to move within a network of Access Points (APs). For example, if a BLE device is connected with AP-1 and moves out of range but comes in range of AP-2, it will be disconnected with AP-1 and connected with AP-2. It is returned by default and mutable.
7.1.2. Multivalued Attributes 🌸
versionSupport: a multivalued set of strings that specifies the BLE versions supported by the device in the form of an array, for example, ["4.1", "4.2", "5.0", "5.1", "5.2", "5.3", "5.4"]. It is required, mutable, and returned by default.
pairingMethods: a multivalued set of strings that specifies pairing methods associated with the BLE device. The pairing methods may require subattributes such as key/password for the device pairing process. To enable the scalability of pairing methods in the future, they are represented as extensions to incorporate various attributes that are part of the respective pairing process. Pairing method extensions are nested inside the BLE extension. It is required, case sensitive, mutable, and returned by default 🥰
7.1.3. BLE Pairing Method Extensions 🦋
okay so the details on pairing methods and their attributes live in Volume 1, Part A, Section 5.2.4 of [BLE54] 📖. this memo defines extensions for four pairing methods that get nested inside the BLE extension schema 🫶. every one of them carries the common attributes from Section 2.1. here's the lineup:
pairingNull extension: 💖 identified by this schema URI:
urn:ietf:params:scim:schemas:extension:pairingNull:2.0:DevicepairingNull has no attributes at all, literally nothing 💀. it allows pairing for BLE devices that don't need a pairing method. so chill, it's giving "no key needed" energy ✨
pairingJustWorks extension: 🌸 identified by this schema URI:
urn:ietf:params:scim:schemas:extension:pairingJustWorks:2.0:Devicethe Just Works pairing method doesn't need a key to pair devices 🙈. for completeness the key attribute is still included, and it's set to 'null' 🍓. the key attribute is required, immutable, and returned by default. no cap, that's a whole vibe 💅
pairingPassKey extension: 🧚 identified by this schema URI:
urn:ietf:params:scim:schemas:extension:pairingPassKey:2.0:Devicethe passkey pairing method requires a 6-digit key to pair devices 🔥. this extension has one singular integer attribute, "key", which is required, mutable, and returned by default. the key pattern is:
^[0-9]{6}$pairingOOB extension: 🎀 identified by this schema URI:
urn:ietf:params:scim:schemas:extension:pairingOOB:2.0:Devicethe out-of-band (OOB) pairing method has three singular attributes: key, randomNumber, and confirmationNumber 👑.
key: 🌈 a string value that is required and received from out-of-band sources such as Near Field Communication (NFC) 📱. it's case sensitive, mutable, and returned by default.
randomNumber: 💜 an integer that represents a nonce added to the key. it's a required attribute, mutable, and returned by default.
confirmationNumber: 🫶 an integer that some solutions require in a RESTful message exchange (where RESTful refers to the Representational State Transfer (REST) architecture) 🌸. it is not required, it's mutable, and it's returned by default if it exists.
here's the characteristics table for the BLE extension schema attributes, all in one place 📋:
+==================+=======+===+=======+=========+========+========+
| Attribute | Multi |Req| Case | Mutable | Return | Unique |
| | Value | | Exact | | | |
+==================+=======+===+=======+=========+========+========+
| deviceMacAddress | F |T | F | RW | Def | Manuf |
+------------------+-------+---+-------+---------+--------+--------+
| isRandom | F |F | F | RW | Def | None |
+------------------+-------+---+-------+---------+--------+--------+
| sepBroadcastAdd | T |F | F | RW | Def | None |
+------------------+-------+---+-------+---------+--------+--------+
| irk | F |F | F | WO | Nev | Manuf |
+------------------+-------+---+-------+---------+--------+--------+
| versionSupport | T |T | F | RW | Def | None |
+------------------+-------+---+-------+---------+--------+--------+
| mobility | F |F | F | RW | Def | None |
+------------------+-------+---+-------+---------+--------+--------+
| pairingMethods | T |T | T | RW | Def | None |
+------------------+-------+---+-------+---------+--------+--------+Table 3: Characteristics of BLE Extension Schema Attributes 📊
Legend: sepBroadcastAdd = separateBroadcastAddress, Req = Required, T = True, F = False, RW = ReadWrite, WO = WriteOnly, Def = Default, Nev = Never, Manuf = Manufacturer 🔑
Example: 🌟
{
"schemas": ["urn:ietf:params:scim:schemas:core:2.0:Device",
"urn:ietf:params:scim:schemas:extension:ble:2.0:Device"],
"id": "e9e30dba-f08f-4109-8486-d5c6a3316111",
"displayName": "BLE Heart Monitor",
"active": true,
"urn:ietf:params:scim:schemas:extension:ble:2.0:Device" : {
"versionSupport": ["5.4"],
"deviceMacAddress": "2C:54:91:88:C9:E2",
"isRandom": false,
"separateBroadcastAddress": ["AA:BB:88:77:22:11", "AA:BB:88:77:\
22:12"],
"mobility": true,
"pairingMethods": ["urn:ietf:params:scim:schemas:extension:\
pairingPassKey:2.0:Device"],
"urn:ietf:params:scim:schemas:extension:pairingPassKey:2.0:\
Device" : {
"key": 123456
}
},
"meta": {
"resourceType": "Device",
"created": "2022-01-23T04:56:22Z",
"lastModified": "2022-05-13T04:42:34Z",
"version": "W\/\"a330bc54f0671c9\"",
"location": "https://example.com/v2/Devices/e9e30dba-f08f-4109-\
8486-d5c6a3316111"
}
}Figure 5: BLE Example 🎀
in the example above, the pairing method is "pairingPassKey", which means this BLE device pairs using only a passkey 🔐. in another example below, the pairing method is "pairingOOB", showing that this BLE device uses the out-of-band pairing method 🦋.
Example: 🌸
{
"schemas": ["urn:ietf:params:scim:schemas:core:2.0:Device",
"urn:ietf:params:scim:schemas:extension:ble:2.0:Device"],
"id": "e9e30dba-f08f-4109-8486-d5c6a3316111",
"displayName": "BLE Heart Monitor",
"active": true,
"urn:ietf:params:scim:schemas:extension:ble:2.0:Device" : {
"versionSupport": ["5.4"],
"deviceMacAddress": "2C:54:91:88:C9:E2",
"isRandom": false,
"separateBroadcastAddress": ["AA:BB:88:77:22:11", "AA:BB:88:77:\
22:12"],
"mobility": true,
"pairingMethods": ["urn:ietf:params:scim:schemas:extension:\
pairingOOB:2.0:Device"],
"urn:ietf:params:scim:schemas:extension:pairingOOB:2.0:Device": {
"key": "TheKeyvalueRetrievedFromOOB",
"randomNumber": 238796813516896
}
},
"meta": {
"resourceType": "Device",
"created": "2022-01-23T04:56:22Z",
"lastModified": "2022-05-13T04:42:34Z",
"version": "W\/\"a330bc54f0671c9\"",
"location": "https://example.com/v2/Devices/e9e30dba-f08f-4109-\
8486-d5c6a3316111"
}
}Figure 6: BLE with pairingOOB 🫶
however, a device can have more than one pairing method 🤯. support for multiple pairing methods is also provided by the multivalued attribute pairingMethods ✨. in the example below, the BLE device can pair with both passkey and OOB pairing methods 💖.
Example: 🧚
{
"schemas": ["urn:ietf:params:scim:schemas:core:2.0:Device",
"urn:ietf:params:scim:schemas:extension:ble:2.0:Device"],
"id": "e9e30dba-f08f-4109-8486-d5c6a3316111",
"displayName": "BLE Heart Monitor",
"active": true,
"urn:ietf:params:scim:schemas:extension:ble:2.0:Device" : {
"versionSupport": ["5.4"],
"deviceMacAddress": "2C:54:91:88:C9:E2",
"isRandom": false,
"separateBroadcastAddress": ["AA:BB:88:77:22:11", "AA:BB:88:77:\
22:12"],
"mobility": true,
"pairingMethods": ["urn:ietf:params:scim:schemas:extension:\
pairingPassKey:2.0:Device",
"urn:ietf:params:scim:schemas:extension:pairingOOB:2.0:\
Device"],
"urn:ietf:params:scim:schemas:extension:pairingPassKey:2.0:\
Device" : {
"key": 123456
},
"urn:ietf:params:scim:schemas:extension:pairingOOB:2.0:Device": {
"key": "TheKeyvalueRetrievedFromOOB",
"randomNumber": 238796813516896
}
},
"meta": {
"resourceType": "Device",
"created": "2022-01-23T04:56:22Z",
"lastModified": "2022-05-13T04:42:34Z",
"version": "W\/\"a330bc54f0671c9\"",
"location": "https://example.com/v2/Devices/e9e30dba-f08f-4109-\
8486-d5c6a3316111"
}
}Figure 7: BLE Pairing with Both Passkey and OOB 👑
7.2. Wi-Fi Easy Connect Extension 📶
this section describes a schema that extends the device schema to enable Wi-Fi Easy Connect (otherwise known as Device Provisioning Protocol (DPP)) 💜. throughout this specification, we use the term "DPP" ✨. the extension is identified by this schema URI:
urn:ietf:params:scim:schemas:extension:dpp:2.0:Devicethe attributes in this extension are adopted from [DPP2] 🌈. here they are.
7.2.1. Singular Attributes 🍓
dppVersion: an integer that represents the version of DPP the device supports 🔥. this attribute is required, case insensitive, mutable, and returned by default.
bootstrapKey: a string value representing an Elliptic Curve Diffie-Hellman (ECDH) public key 🔐. the base64-encoded lengths for P-256, P-384, and P-521 are 80, 96, and 120 characters 💅. this attribute is required, case sensitive, write only, and never returned 🙈.
deviceMacAddress: a MAC address stored as a string 📱. it's a unique 48-bit value 🦋. this attribute is optional, case insensitive, mutable, and returned by default. its form is identical to that of the deviceMacAddress for BLE devices 🫶.
serialNumber: an alphanumeric serial number stored as a string 🌸. it may also be passed as bootstrapping information 🧚. this attribute is optional, case insensitive, mutable, and returned by default ✨.
7.2.2. Multivalued Attributes 💖
okay so this part is where the multivalued attributes for the Wi-Fi Easy Connect extension live, and bestie, the tables are giving main character energy 💅
bootstrappingMethod: One or more strings of all the bootstrapping methods available on the enrollee device, for example, [QR, NFC]. This attribute is optional, case insensitive, mutable, and returned by default. 🎀
classChannel: One or more strings representing the global operating class and channel shared as bootstrapping information. It is formatted as class/channel, for example, ['81/1','115/36']. This attribute is optional, case insensitive, mutable, and returned by default. ✨
Here's the full characteristics table for the DPP extension schema attributes, slay 🦋
+=====================+=====+===+=====+=========+========+========+
| Attribute |Multi|Req|Case | Mutable | Return | Unique |
| |Value| |Exact| | | |
+=====================+=====+===+=====+=========+========+========+
| dppVersion |F |T |F | RW | Def | None |
+---------------------+-----+---+-----+---------+--------+--------+
| bootstrapKey |F |T |T | WO | Nev | None |
+---------------------+-----+---+-----+---------+--------+--------+
| deviceMacAddress |F |F |F | RW | Def | Manuf |
+---------------------+-----+---+-----+---------+--------+--------+
| serialNumber |F |F |F | RW | Def | None |
+---------------------+-----+---+-----+---------+--------+--------+
| bootstrappingMethod |T |F |F | RW | Def | None |
+---------------------+-----+---+-----+---------+--------+--------+
| classChannel |T |F |F | RW | Def | None |
+---------------------+-----+---+-----+---------+--------+--------+Table 4: Characteristics of DPP Extension Schema Attributes
Legend: Req = Required, T = True, F = False, RW = ReadWrite, WO = WriteOnly, Def = Default, Nev = Never, Manuf = Manufacturer
Example time 🧚 Here's the DPP device, with its bootstrapping info and everything:
{
"schemas": ["urn:ietf:params:scim:schemas:core:2.0:Device",
"urn:ietf:params:scim:schemas:extension:dpp:2.0:\
Device"],
"id": "e9e30dba-f08f-4109-8486-d5c6a3316111",
"displayName": "WiFi Heart Monitor",
"active": true,
"urn:ietf:params:scim:schemas:extension:dpp:2.0:Device" : {
"dppVersion": 2,
"bootstrappingMethod": ["QR"],
"bootstrapKey": "\
MDkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDIgADURzxmttZoIRIPWGoQMV00XHWCAQIhXru\
VWOz0NjlkIA=",
"deviceMacAddress": "2C:54:91:88:C9:F2",
"classChannel": ["81/1", "115/36"],
"serialNumber": "4774LH2b4044"
},
"meta": {
"resourceType": "Device",
"created": "2022-01-23T04:56:22Z",
"lastModified": "2022-05-13T04:42:34Z",
"version": "W\/\"a330bc54f0671c9\"",
"location": "https://example.com/v2/Devices/e9e30dba-f08f-\
4109-8486-d5c6a3316111"
}
}Figure 8: DPP Example
7.3. Ethernet MAB Extension ✨
This extension enables a legacy means of (very) weak authentication, known as MAC Authenticated Bypass (MAB), that is supported in many wired ethernet solutions. If the MAC address is known, then the device may be permitted (perhaps limited) access. The extension is identified by the following URI:
urn:ietf:params:scim:schemas:extension:ethernet-mab:2.0:DeviceNote that this method is not likely to work properly with MAC address randomization. 🙈
7.3.1. Single Attribute 🌸
This extension has a singular attribute:
deviceMacAddress: This is the Ethernet address to be provisioned onto the network. It takes the identical form as found in the BLE extension.
+==================+=======+===+=======+=========+========+========+
| Attribute | Multi |Req| Case | Mutable | Return | Unique |
| | Value | | Exact | | | |
+==================+=======+===+=======+=========+========+========+
| deviceMacAddress | F |T | F | RW | Def | None |
+------------------+-------+---+-------+---------+--------+--------+Table 5: Characteristics of MAB Extension Schema Attributes
Legend: Req = Required, T = True, F = False, RW = ReadWrite, Def = Default
Example, bestie 🎀
{
"schemas": ["urn:ietf:params:scim:schemas:core:2.0:Device",
"urn:ietf:params:scim:schemas:extension:ethernet-mab:2.0:Device\
"],
"id": "e9e30dba-f08f-4109-8486-d5c6a3316111",
"displayName": "Some random Ethernet Device",
"active": true,
"urn:ietf:params:scim:schemas:extension:ethernet-mab:2.0:Device" \
: {
"deviceMacAddress": "2C:54:91:88:C9:E2"
},
"meta": {
"resourceType": "Device",
"created": "2022-01-23T04:56:22Z",
"lastModified": "2022-05-13T04:42:34Z",
"version": "W\/\"a330bc54f0671c9\"",
"location": "https://example.com/v2/Devices/e9e30dba-f08f-4109-\
8486-d5c6a3316111"
}
}Figure 9: MAB Example
7.4. FIDO Device Onboard Extension 🔥
This extension specifies a voucher to be used by the FDO Device Onboard (FDO) protocols [FDO11] to complete a trusted transfer of ownership and control of the device to the environment. The SCIM server MUST know how to process the voucher, either directly or by forwarding it along to an owner process as defined in the FDO specification. The extension is identified using the following schema URI:
urn:ietf:params:scim:schemas:extension:fido-device-onboard:2.0:Device7.4.1. Single Attribute 👑
This extension has a singular attribute:
fdoVoucher: The voucher is formatted as a PEM-encoded object in accordance with [FDO11].
+============+=======+=====+=======+=========+========+========+
| Attribute | Multi | Req | Case | Mutable | Return | Unique |
| | Value | | Exact | | | |
+============+=======+=====+=======+=========+========+========+
| fdoVoucher | F | T | F | WO | Nev | None |
+------------+-------+-----+-------+---------+--------+--------+Table 6: Characteristics of FDO Extension Schema Attributes
Legend: Req = Required, T = True, F = False, WO = WriteOnly, Nev = Never
Example:
{
"schemas": ["urn:ietf:params:scim:schemas:core:2.0:Device",
"urn:ietf:params:scim:schemas:extension:fido-device-onboard:2.0\
:Device"],
"id": "e9e30dba-f08f-4109-8486-d5c6a3316111",
"displayName": "Some random Ethernet Device",
"active": true,
"urn:ietf:params:scim:schemas:extension:fido-device-onboard:2.0:\
Device" : {
"fdoVoucher": "{... voucher ...}"
},
"meta": {
"resourceType": "Device",
"created": "2022-01-23T04:56:22Z",
"lastModified": "2022-05-13T04:42:34Z",
"version": "W\/\"a330bc54f0671c9\"",
"location": "https://example.com/v2/Devices/e9e30dba-f08f-4109-\
8486-d5c6a3316111"
}
}Figure 10: FDO Example
7.5. Zigbee Extension 🌈
This section describes a schema that extends the device schema to enable the provisioning of Zigbee devices [Zigbee]. The extension is identified using the following schema URI:
urn:ietf:params:scim:schemas:extension:zigbee:2.0:DeviceIt has one singular attribute and one multivalued attribute. The attributes are as follows.
7.5.1. Singular Attribute 💜
deviceEui64Address: A 64-bit Extended Unique Identifier (EUI-64) device address stored as string. This attribute is required, case insensitive, mutable, and returned by default. It takes the same form as the deviceMacAddress in the BLE extension.
7.5.2. Multivalued Attribute 🍓
versionSupport: One or more strings of all the Zigbee versions supported by the device, for example, [3.0]. This attribute is required, case insensitive, mutable, and returned by default.
+====================+=====+===+=======+=========+========+========+
| Attribute |Multi|Req| Case | Mutable | Return | Unique |
| |Value| | Exact | | | |
+====================+=====+===+=======+=========+========+========+
| deviceEui64Address |F |T | F | RW | Def | None |
+--------------------+-----+---+-------+---------+--------+--------+
| versionSupport |T |T | F | RW | Def | None |
+--------------------+-----+---+-------+---------+--------+--------+Table 7: Characteristics of Zigbee Extension Schema Attributes
Legend: Req = Required, T = True, F = False, RW = ReadWrite, Def = Default
Example:
{
"schemas": ["urn:ietf:params:scim:schemas:core:2.0:Device",
"urn:ietf:params:scim:schemas:extension:zigbee:2.0:Device"],
"id": "e9e30dba-f08f-4109-8486-d5c6a3316111",
"displayName": "Zigbee Heart Monitor",
"active": true,
"urn:ietf:params:scim:schemas:extension:zigbee:2.0:Device" : {
"versionSupport": ["3.0"],
"deviceEui64Address": "50:32:5F:FF:FE:E7:67:28"
},
"meta": {
"resourceType": "Device",
"created": "2022-01-23T04:56:22Z",
"lastModified": "2022-05-13T04:42:34Z",
"version": "W\/\"a330bc54f0671c9\"",
"location": "https://example.com/v2/Devices/e9e30dba-f08f-4109-\
8486-d5c6a3316111"
}
}Figure 11: Zigbee Example
7.6. The Endpoint Applications Extension Schema 🧚
Sometimes non-IP devices such as those using BLE or Zigbee require an application gateway interface to manage them. 🫶
endpointAppsExt provides the list of applications that connect to an enterprise gateway. endpointAppsExt has one multivalued attribute and two singular attributes. The extension is identified using the following schema URI:
urn:ietf:params:scim:schemas:extension:endpointAppsExt:2.0:Device7.6.1. Singular Attributes ✨
okay so there are two singular attributes here and they're both read-only, which is lowkey iconic 💅
deviceControlEnterpriseEndpoint: a string holding the URL of the enterprise endpoint used to reach the enterprise gateway. when the enterprise gets the SCIM object from the onboarding application, it adds this attribute and sends the object back to the onboarding application as a response. this attribute is required, case sensitive, read-only, and returned by default. the enterprise is the one who enforces uniqueness 🔐
telemetryEnterpriseEndpoint: a string holding a URL of the enterprise endpoint used to reach an enterprise gateway for telemetry 📡 same flow as above: the enterprise adds it to the SCIM object and sends it back to the onboarding application. this attribute is optional, case sensitive, read-only, and returned by default, and the enterprise enforces uniqueness here too. it only gets populated when the enterprise actually provides a telemetry endpoint (for example, one hosted by the enterprise gateway). if the SCIM server doesn't know about a telemetry service, the attribute just won't be returned 🙈 in that case, if the application needs telemetry, separate arrangements must be made.
7.6.2. Multivalued Attribute 🦋
applications: a multivalued attribute made up of one or more complex attributes, each representing an endpoint application. the list covers deviceControl and telemetry. every entry has two attributes, "value" and "$ref".
value: a string containing the identifier of the endpoint application, formatted as a Universally Unique Identifier (UUID) 🆔 it's the same as the common attribute "$id" of the EndpointApp resource. it's read/write, required, case insensitive, and returned by default.
$ref: a reference to the matching EndpointApp resource object stored in the SCIM server. it's readOnly, required, case sensitive, and returned by default.
Here's the whole attribute breakdown in one table, because it's so much easier to scan at a glance 👀
+====================+=====+===+=======+=========+========+========+
| Attribute |Multi|Req| Case | Mutable | Return | Unique |
| |Value| | Exact | | | |
+====================+=====+===+=======+=========+========+========+
| devContEntEndpoint |F |T | T | RO | Def | Ent |
+--------------------+-----+---+-------+---------+--------+--------+
| telEntEndpoint |F |F | T | RO | Def | Ent |
+--------------------+-----+---+-------+---------+--------+--------+
| applications |T |T | F | RW | Def | None |
+--------------------+-----+---+-------+---------+--------+--------+
| value |F |T | F | RW | Def | None |
+--------------------+-----+---+-------+---------+--------+--------+
| $ref |F |T | T | RO | Def | None |
+--------------------+-----+---+-------+---------+--------+--------+
Table 8: Characteristics of endpointAppsExt Extension Schema
AttributesLegend, for the shorthand-lovers 🍓
Legend: devContEntEndpoint = deviceControlEnterpriseEndpoint,
telEntEndpoint = telemetryEnterpriseEndpoint,
Req = Required, T = True, F = False, RO = ReadOnly,
RW = ReadWrite, Ent = Enterprise, Def = DefaultAnd here's a full example so you can see how it all clicks together 🧚
Example:
<CODE BEGINS>
{
"schemas": ["urn:ietf:params:scim:schemas:core:2.0:Device",
"urn:ietf:params:scim:schemas:extension:ble:2.0:Device",
"urn:ietf:params:scim:schemas:extension:endpointAppsExt:2.0:\
Device"],
"id": "e9e30dba-f08f-4109-8486-d5c6a3316111",
"displayName": "BLE Heart Monitor",
"active": true,
"urn:ietf:params:scim:schemas:extension:ble:2.0:Device" : {
"versionSupport": ["5.4"],
"deviceMacAddress": "2C:54:91:88:C9:E2",
"isRandom": false,
"separateBroadcastAddress": ["AA:BB:88:77:22:11", "AA:BB:88:77:\
22:12"],
"mobility": false,
"pairingMethods": [
"urn:ietf:params:scim:schemas:extension:pairingPassKey:2.0:\
Device"],
"urn:ietf:params:scim:schemas:extension:pairingPassKey:2.0:\
Device" : {
"key": 123456
}
},
"urn:ietf:params:scim:schemas:extension:endpointAppsExt:2.0:Device\
": {
"applications": [
{
"value" : "e9e30dba-f08f-4109-8486-d5c6a3316212",
"$ref" : "https://example.com/v2/EndpointApps/e9e30dba-f08f-\
4109-8486-d5c6a3316212"
},
{
"value" : "e9e30dba-f08f-4109-8486-d5c6a3316333",
"$ref" : "https://example.com/v2/EndpointApps/e9e30dba-f08f-\
4109-8486-d5c6a3316333"
}
],
"deviceControlEnterpriseEndpoint": "https://example.com/\
device_control_app_endpoint/",
"telemetryEnterpriseEndpoint": "mqtts://example.com/\
telemetry_app_endpoint/"
},
"meta": {
"resourceType": "Device",
"created": "2022-01-23T04:56:22Z",
"lastModified": "2022-05-13T04:42:34Z",
"version": "W\/\"a330bc54f0671c9\"",
"location": "https://example.com/v2/Devices/e9e30dba-f08f-4109-\
8486-d5c6a3316111"
}
}
<CODE ENDS>Figure 12: Endpoint Applications Extension Example 🎀
The endpointAppsExt schema, along with the BLE extension, is written out in JSON in Appendix A.9, and the OpenAPI version is in Appendix B.8 📚
8. Security Considerations 🔐
Provisioning lets devices onto a network, so this part is serious, bestie. Each SCIM client MUST be appropriately authenticated. no exceptions 🙅♀️
8.1. SCIM Operations
An attacker that has authenticated to a trusted SCIM client could mess with parts of the SCIM database 😬 to make the risks clear, each operation is spelled out below.
8.1.1. Unauthorized Object Creation
An authenticated attacker could try to add elements that the enterprise wouldn't normally allow on its network. for example, an enterprise may not want devices with well-known vulnerabilities showing up in its environment. to mitigate this, network administrators should layer additional policies about which devices are permitted on the network.
An attacker that gets into SCIM could try to add an IP-based device that itself attempts unauthorized access, basically acting like a bot 🤖 Network administrators SHOULD establish appropriate access-control policies that follow the principle of least privilege to mitigate this attack.
8.2. Object Deletion
Once access is granted, the server may or may not act when the object is removed 🤷♀️ deleting the object is a signal from the application that it no longer expects the device to be on the network. it's strictly up to the SCIM server and its back-end policy to decide whether to revoke access to the infrastructure. It is RECOMMENDED that SCIM delete operations trigger a workflow in accordance with local network policy.
8.3. Read Operations
Read operations are how an application syncs its state, so it knows which devices it's supposed to manage 📋 an attacker with access to SCIM objects might get access to the devices themselves. to stop one SCIM client from interfering with devices it has no business managing, only clients that created the objects, or the ones they authorize, SHOULD be able to read those objects 🔒
8.4. Update Operations
Update operations may be necessary if a device has been changed in some way 🛠️ attackers with update access might be able to cut a device off from the network, or cut a network off from its devices 😱 to avoid that, the same access control policy used for read operations is RECOMMENDED here too.
8.5. Higher Level Protection for Certain Systems
Devices provisioned with this model may be completely controlled by the administrator of the SCIM server, depending on how those systems are defined 🎛️ for instance, if BLE passkeys are provided, the device can be connected to, and maybe paired with. if the administrator of the SCIM client doesn't want the network to have full access to the device, the device itself MUST support finer levels of access control and additional authentication mechanisms. any extra security has to come from higher application layers. for example, if client applications want to keep private information flowing to and from the device, they should encrypt that information over-the-top 🔐✨
8.6. Logging
An attacker could figure out which devices are on a network just by examining SCIM logs 👀 because SCIM operations are sensitive, logs SHOULD be encrypted both on disk and in transit 💜
9. IANA Considerations 📝
9.1. New Schemas
IANA has added the following entries to the "SCIM Schema URIs for Data Resources" registry 🗂️
Schema URI: urn:ietf:params:scim:schemas:core:2.0:Device
Name: Core Device Schema
Reference: RFC 9944, Section 3
Schema URI: urn:ietf:params:scim:schemas:core:2.0:EndpointApp
Name: Endpoint Application
Reference: RFC 9944, Section 69.2. Device Schema Extensions
IANA has created the following extensions in the "SCIM Server-Related Schema URIs" registry (leaving out the "Resource Type" field) as described in Section 7 🌸
Schema URI: urn:ietf:params:scim:schemas:extension:ble:2.0:Device
Name: BLE Extension
Resource Type: Device
Reference: RFC 9944, Section 7.1
Schema URI:
urn:ietf:params:scim:schemas:extension:ethernet-mab:2.0:Device
Name: Ethernet MAB
Resource Type: Device
Reference: RFC 9944, Section 7.3
Schema URI:
urn:ietf:params:scim:schemas:extension:fido-device-
onboard:2.0:Device
Name: FIDO Device Onboard
Resource Type: Device
Reference: RFC 9944, Section 7.4
Schema URI: urn:ietf:params:scim:schemas:extension:dpp:2.0:Device
Name: Wi-Fi Easy Connect
Resource Type: Device
Reference: RFC 9944, Section 7.2
Schema URI:
urn:ietf:params:scim:schemas:extension:endpointAppsExt:2.0:Device
Name: Application Endpoint Extension
Resource Type: Device
Reference: RFC 9944, Section 7.6
Schema URI:
urn:ietf:params:scim:schemas:extension:pairingJustWorks:2.0:Device
Name: Just Works Auth BLE
Resource Type: Device
Reference: RFC 9944, Section 7.1.3
Schema URI:
urn:ietf:params:scim:schemas:extension:pairingOOB:2.0:Device
Name: Out-of-Band Pairing for BLE
Resource Type: Device
Reference: RFC 9944, Section 7.1.3
Schema URI:
urn:ietf:params:scim:schemas:extension:pairingPassKey:2.0:Device
Name: Passkey Pairing for BLE
Resource Type: Device
Reference: RFC 9944, Section 7.1.3
Schema URI:
urn:ietf:params:scim:schemas:extension:pairingNull:2.0:Device
Name: Pairing Null
Resource Type: Device
Reference: RFC 9944, Section 7.1.3
Schema URI: urn:ietf:params:scim:schemas:extension:zigbee:2.0:Device
Name: Zigbee
Resource Type: Device
Reference: RFC 9944, Section 7.510. References 📚
10.1. Normative References 📚✨
These are the must-read specs for this doc, bestie, so grab your snacks 🍓
- [BLE54] Bluetooth SIG, "Bluetooth Core Specification", Version 5.4, 2023,
https://www.bluetooth.org/DocMan/handlers/DownloadDoc.ashx?doc_id=587177. - [DPP2] Wi-Fi Alliance, "Wi-Fi Easy Connect Specification", Version 3.0, 2020,
https://www.wi-fi.org/system/files/Wi-Fi_Easy_Connect_Specification_v3.0.pdf. - [ECMA] ECMA International, "ECMAScript(R) 2025 Language Specification", ECMA-262, 16th Edition, June 2025,
https://ecma-international.org/publications-and-standards/standards/ecma-262/. - [FDO11] FIDO Alliance, "FIDO Device Onboard Specification 1.1", Proposed Standard, April 2022,
https://fidoalliance.org/specs/FDO/FIDO-Device-Onboard-PS-v1.1-20220419/FIDO-Device-Onboard-PS-v1.1-20220419.html. - [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, DOI 10.17487/RFC2119, March 1997,
https://www.rfc-editor.org/info/rfc2119. - [RFC4648] Josefsson, S., "The Base16, Base32, and Base64 Data Encodings", RFC 4648, DOI 10.17487/RFC4648, October 2006,
https://www.rfc-editor.org/info/rfc4648. - [RFC5280] Cooper, D., Santesson, S., Farrell, S., Boeyen, S., Housley, R., and W. Polk, "Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile", RFC 5280, DOI 10.17487/RFC5280, May 2008,
https://www.rfc-editor.org/info/rfc5280. - [RFC7643] Hunt, P., Ed., Grizzle, K., Wahlstroem, E., and C. Mortimore, "System for Cross-domain Identity Management: Core Schema", RFC 7643, DOI 10.17487/RFC7643, September 2015,
https://www.rfc-editor.org/info/rfc7643. - [RFC7644] Hunt, P., Ed., Grizzle, K., Ansari, M., Wahlstroem, E., and C. Mortimore, "System for Cross-domain Identity Management: Protocol", RFC 7644, DOI 10.17487/RFC7644, September 2015,
https://www.rfc-editor.org/info/rfc7644. - [RFC8174] Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC 2119 Key Words", BCP 14, RFC 8174, DOI 10.17487/RFC8174, May 2017,
https://www.rfc-editor.org/info/rfc8174. - [RFC8520] Lear, E., Droms, R., and D. Romascanu, "Manufacturer Usage Description Specification", RFC 8520, DOI 10.17487/RFC8520, March 2019,
https://www.rfc-editor.org/info/rfc8520. - [Zigbee] Zigbee Alliance, "Zigbee Specification", ZigBee Document 05-3474-21, August 2015,
https://zigbeealliance.org/wp-content/uploads/2019/11/docs-05-3474-21-0csg-zigbee-specification.pdf.
10.2. Informative References 🧚
These ones are the extra-credit reading, the "oh wait, let me look that up" list 💅
- [JSONSchema] Wright, A., Ed., Andrews, H. A., Ed., Hutton, B., Ed., and G. Dennis, "JSON Schema: A Media Type for Describing JSON Documents", December 2022,
https://json-schema.org/draft/2020-12/json-schema-core. - [NIPC] Brinckman, B., Mohan, R., and B. Sanford, "An Application Layer Interface for Non-Internet-Connected Physical Components (NIPC)", Work in Progress, Internet-Draft, draft-ietf-asdf-nipc-19, 21 April 2026,
https://datatracker.ietf.org/doc/html/draft-ietf-asdf-nipc-19. - [OAUTHv2] Hardt, D., Ed., "The OAuth 2.0 Authorization Framework", RFC 6749, DOI 10.17487/RFC6749, October 2012,
https://www.rfc-editor.org/info/rfc6749. - [OpenAPI] Swagger, "OpenAPI Specification", Version 3.1.1, October 2024,
https://swagger.io/specification/. - [RFC6241] Enns, R., Ed., Bjorklund, M., Ed., Schoenwaelder, J., Ed., and A. Bierman, Ed., "Network Configuration Protocol (NETCONF)", RFC 6241, DOI 10.17487/RFC6241, June 2011,
https://www.rfc-editor.org/info/rfc6241. - [RFC7950] Bjorklund, M., Ed., "The YANG 1.1 Data Modeling Language", RFC 7950, DOI 10.17487/RFC7950, August 2016,
https://www.rfc-editor.org/info/rfc7950. - [RFC8040] Bierman, A., Bjorklund, M., and K. Watsen, "RESTCONF Protocol", RFC 8040, DOI 10.17487/RFC8040, January 2017,
https://www.rfc-editor.org/info/rfc8040. - [RFC8792] Watsen, K., Auerswald, E., Farrel, A., and Q. Wu, "Handling Long Lines in Content of Internet-Drafts and RFCs", RFC 8792, DOI 10.17487/RFC8792, June 2020,
https://www.rfc-editor.org/info/rfc8792. - [RFC8995] Pritikin, M., Richardson, M., Eckert, T., Behringer, M., and K. Watsen, "Bootstrapping Remote Secure Key Infrastructure (BRSKI)", RFC 8995, DOI 10.17487/RFC8995, May 2021,
https://www.rfc-editor.org/info/rfc8995.
Appendix A. JSON Schema Representation 🎀
Okay, the schema corner is here, and it's giving pure JSON realness 🤓💖
A.1. Resource Schema 🌸
<CODE BEGINS>
[
{
"schemas": ["urn:ietf:params:scim:schemas:core:2.0:ResourceType"\
],
"id": "Device",
"name": "Device",
"endpoint": "/Devices",
"description": "Device account.",
"schema": "urn:ietf:params:scim:schemas:core:2.0:Device",
"meta": {
"location": "https://example.com/v2/ResourceTypes/Device",
"resourceType": "ResourceType"
}
},
{
"schemas": ["urn:ietf:params:scim:schemas:core:2.0:ResourceType"\
],
"id": "EndpointApp",
"name": "EndpointApp",
"endpoint": "/EndpointApps",
"description": "Endpoint application such as device control and \
telemetry.",
"schema": "urn:ietf:params:scim:schemas:core:2.0:EndpointApp",
"meta": {
"location": "https://example.com/v2/ResourceTypes/EndpointApps",
"resourceType": "ResourceType"
}
}
]
<CODE ENDS>A.2. Core Device Schema 💅
<CODE BEGINS>
{
"id": "urn:ietf:params:scim:schemas:core:2.0:Device",
"name": "Device",
"description": "Entry containing attributes about a device.",
"attributes" : [
{
"name": "displayName",
"type": "string",
"description": "Human-readable name of the device, suitable \
for displaying to end users, for example, 'BLE Heart Monitor' etc.",
"multiValued": false,
"required": false,
"caseExact": false,
"mutability": "readWrite",
"returned": "default",
"uniqueness": "none"
},
{
"name": "active",
"type": "boolean",
"description": "A mutable boolean value indicating the device \
administrative status. If true, the commands (such as connect, \
disconnect, subscribe) that control app sends to the controller for \
the devices will be processed by the controller. If false, any \
command coming from the control app for the device will be \
rejected by the controller.",
"multiValued": false,
"required": true,
"caseExact": false,
"mutability": "readWrite",
"returned": "default",
"uniqueness": "none"
},
{
"name": "mudUrl",
"type": "reference",
"description": "A URL to MUD file of the device (RFC 8520).",
"multiValued": false,
"required": false,
"caseExact": true,
"mutability": "readWrite",
"returned": "default",
"uniqueness": "none"
},
{
"name": "groups",
"type": "complex",
"multiValued": true,
"description": "A list of groups to which the device belongs, \
either through direct membership, through nested groups, or \
dynamically calculated.",
"required": false,
"subAttributes": [
{
"name": "value",
"type": "string",
"multiValued": false,
"description": "The identifier of the device's group.",
"required": false,
"caseExact": false,
"mutability": "readOnly",
"returned": "default",
"uniqueness": "none"
},
{
"name": "$ref",
"type": "reference",
"referenceTypes": [
"Group"
],
"multiValued": false,
"description": "The URI of the corresponding 'Group' \
resource to which the device belongs.",
"required": false,
"caseExact": false,
"mutability": "readOnly",
"returned": "default",
"uniqueness": "none"
},
{
"name": "display",
"type": "string",
"multiValued": false,
"description": "A human-readable name, primarily used for \
display purposes. READ-ONLY.",
"required": false,
"caseExact": false,
"mutability": "readOnly",
"returned": "default",
"uniqueness": "none"
},
{
"name": "type",
"type": "string",
"multiValued": false,
"description": "A label indicating the attribute's \
function, e.g., 'direct' or 'indirect'.",
"required": false,
"caseExact": false,
"canonicalValues": [
"direct",
"indirect"
],
"mutability": "readOnly",
"returned": "default",
"uniqueness": "none"
}
],
"mutability": "readOnly",
"returned": "default"
}
],
"meta" : {
"resourceType" : "Schema",
"location" :
"/v2/Schemas/urn:ietf:params:scim:schemas:core:2.0:Device"
}
}
<CODE ENDS>A.3. EndpointApp Schema ✨
okay so this is the EndpointApp schema 💖 it's where endpoint apps and their credentials live, bestie. I copied it over exactly, character for character, so nothing gets lost 🫶
{
"id": "urn:ietf:params:scim:schemas:core:2.0:EndpointApp",
"name": "EndpointApp",
"description": "Endpoint application and their credentials.",
"attributes" : [
{
"name": "applicationType",
"type": "string",
"description": "This attribute will only contain two values: \
deviceControl or telemetry.",
"multiValued": false,
"required": true,
"caseExact": false,
"mutability": "readOnly",
"returned": "default",
"uniqueness": "none"
},
{
"name": "applicationName",
"type": "string",
"description": "Human-readable name of the application.",
"multiValued": false,
"required": true,
"caseExact": false,
"mutability": "readWrite",
"returned": "default",
"uniqueness": "none"
},
{
"name": "certificateInfo",
"type": "complex",
"description": "Contains X.509 certificate's subject name and \
root CA information associated with the device control or telemetry \
app.",
"multiValued": false,
"required": false,
"caseExact": false,
"mutability": "readWrite",
"returned": "default",
"uniqueness": "none",
"subAttributes" : [
{
"name" : "rootCA",
"type" : "string",
"description" : "The base64 encoding of the DER encoding \
of the CA certificate.",
"multiValued" : false,
"required" : false,
"caseExact" : true,
"mutability" : "readWrite",
"returned" : "default",
"uniqueness" : "none"
},
{
"name" : "subjectName",
"type" : "string",
"description" : "A Common Name (CN) of the form of CN = \
dnsName.",
"multiValued" : false,
"required" : true,
"caseExact" : true,
"mutability" : "readWrite",
"returned" : "default",
"uniqueness" : "none"
}
]
},
{
"name": "clientToken",
"type": "string",
"description": "This attribute contains a token that the \
client will use to authenticate itself. Each token may be a string \
up to 500 characters in length.",
"multiValued": false,
"required": false,
"caseExact": true,
"mutability": "readOnly",
"returned": "default",
"uniqueness": "none"
},
{
"name": "groups",
"type": "complex",
"multiValued": true,
"description": "A list of groups to which an endpoint \
application belongs, either through direct membership, through \
nested groups, or dynamically calculated.",
"required": false,
"subAttributes": [
{
"name": "value",
"type": "string",
"multiValued": false,
"description": "The identifier of the endpoint application\
's group.",
"required": false,
"caseExact": false,
"mutability": "readOnly",
"returned": "default",
"uniqueness": "none"
},
{
"name": "$ref",
"type": "reference",
"referenceTypes": [
"Group"
],
"multiValued": false,
"description": "The URI of the corresponding 'Group' \
resource to which the endpoint application belongs.",
"required": false,
"caseExact": false,
"mutability": "readOnly",
"returned": "default",
"uniqueness": "none"
},
{
"name": "display",
"type": "string",
"multiValued": false,
"description": "A human-readable name, primarily used for \
display purposes. READ-ONLY.",
"required": false,
"caseExact": false,
"mutability": "readOnly",
"returned": "default",
"uniqueness": "none"
},
{
"name": "type",
"type": "string",
"multiValued": false,
"description": "A label indicating the attribute's \
function, e.g., 'direct' or 'indirect'.",
"required": false,
"caseExact": false,
"canonicalValues": [
"direct",
"indirect"
],
"mutability": "readOnly",
"returned": "default",
"uniqueness": "none"
}
],
"mutability": "readOnly",
"returned": "default"
}
],
"meta" : {
"resourceType" : "Schema",
"location" :
"/v2/Schemas/urn:ietf:params:scim:schemas:core:2.0:EndpointApp"
}
}A.4. BLE Extension Schema 🦋
Okay, bestie, this one is the Bluetooth Low Energy schema, and it's giving full main character energy 💅 It's a list of schemas: one for the extension, plus a few for the pairing methods.
[
{
"id": "urn:ietf:params:scim:schemas:extension:ble:2.0:Device",
"name": "bleExtension",
"description": "BLE extension for device account.",
"attributes" : [
{
"name": "versionSupport",
"type": "string",
"description": "Provides a list of all the BLE versions \
supported by the device, for example, [4.1, 4.2, 5.0, 5.1, 5.2, 5.4]\
.",
"multiValued": true,
"required": true,
"caseExact": false,
"mutability": "readWrite",
"returned": "default",
"uniqueness": "none"
},
{
"name": "deviceMacAddress",
"type": "string",
"pattern": "^[0-9A-Fa-f]{2}(:[0-9A-Fa-f]{2}){5}$",
"description": "A unique public MAC address assigned by the \
manufacturer.",
"multiValued": false,
"required": true,
"caseExact": false,
"mutability": "readWrite",
"returned": "default",
"uniqueness": "Manufacturer"
},
{
"name": "isRandom",
"type": "boolean",
"description": "The isRandom flag is taken from the BLE \
core specifications 5.4. If true, device is using a random address\
. Default value is false.",
"multiValued": false,
"required": false,
"caseExact": false,
"mutability": "readWrite",
"returned": "default",
"uniqueness": "none"
},
{
"name": "separateBroadcastAddress",
"type": "string",
"description": "When present, this address is used for \
broadcasts/advertisements. This value MUST NOT be set when an IRK \
is provided. Its form is the same as deviceMacAddress.",
"multiValued": true,
"required": false,
"caseExact": false,
"mutability": "readWrite",
"returned": "default",
"uniqueness": "none"
},
{
"name": "irk",
"type": "string",
"description": "Identity Resolving Key (IRK), which is \
unique for every device. It is used to resolve a random address. \
This value MUST NOT be set when separateBroadcastAddress is set.",
"multiValued": false,
"required": false,
"caseExact": false,
"mutability": "writeOnly",
"returned": "never",
"uniqueness": "Manufacturer"
},
{
"name": "mobility",
"type": "boolean",
"description": "If set to true, the BLE device will \
automatically connect to the closest AP. For example, if a BLE \
device is connected with AP-1 and moves out of range but comes in \
range of AP-2, it will be disconnected with AP-1 and \
connected with AP-2.",
"multiValued": false,
"required": false,
"caseExact": false,
"mutability": "readWrite",
"returned": "default",
"uniqueness": "none"
},
{
"name": "pairingMethods",
"type": "string",
"description": "List of pairing methods associated with the \
BLE device, stored as schema URI.",
"multiValued": true,
"required": true,
"caseExact": true,
"mutability": "readWrite",
"returned": "default",
"uniqueness": "none"
}
],
"meta" : {
"resourceType" : "Schema",
"location" : "/v2/Schemas/urn:ietf:params:scim:schemas:\
extension:ble:2.0:Device"
}
},
{
"id": "urn:ietf:params:scim:schemas:extension:pairingNull:2.0:\
Device",
"name": "nullPairing",
"description": "Null pairing method for BLE. It is included for \
the devices that do not have a pairing method.",
"meta" : {
"resourceType" : "Schema",
"location" : "/v2/Schemas/urn:ietf:params:scim:schemas:\
extension:pairingNull:2.0:Device"
}
},
{
"id": "urn:ietf:params:scim:schemas:extension:pairingJustWorks:2\
.0:Device",
"name": "pairingJustWorks",
"description": "Just Works pairing method for BLE.",
"attributes" : [
{
"name": "key",
"type": "integer",
"description": "Just Works does not have any key value. For \
completeness, it is added with a key value 'null'.",
"multiValued": false,
"required": false,
"caseExact": false,
"mutability": "immutable",
"returned": "default",
"uniqueness": "none"
}
],
"meta" : {
"resourceType" : "Schema",
"location" : "/v2/Schemas/urn:ietf:params:scim:schemas:\
extension:pairingJustWorks:2.0:Device"
}
},
{
"id": "urn:ietf:params:scim:schemas:extension:pairingPassKey:2.0\
:Device",
"name": "pairingPassKey",
"description": "Pass key pairing method for BLE.",
"attributes" : [
{
"name": "key",
"type": "integer",
"description": "A six-digit passkey for BLE a device. The \
pattern of key is ^[0-9]{6}$.",
"multiValued": false,
"required": true,
"caseExact": false,
"mutability": "readWrite",
"returned": "default",
"uniqueness": "none"
}
],
"meta" : {
"resourceType" : "Schema",
"location" : "/v2/Schemas/urn:ietf:params:scim:schemas:\
extension:pairingPassKey:2.0:Device"
}
},
{
"id": "urn:ietf:params:scim:schemas:extension:pairingOOB:2.0:\
Device",
"name": "pairingOOB",
"description": "Out-of-band pairing method for BLE.",
"attributes" : [
{
"name": "key",
"type": "string",
"description": "A key value retrieved from out-of-band \
source such as NFC.",
"multiValued": false,
"required": true,
"caseExact": true,
"mutability": "readWrite",
"returned": "default",
"uniqueness": "none"
},
{
"name": "randomNumber",
"type": "integer",
"description": "Nonce added to the key.",
"multiValued": false,
"required": true,
"caseExact": false,
"mutability": "readWrite",
"returned": "default",
"uniqueness": "none"
},
{
"name": "confirmationNumber",
"type": "integer",
"description": "Some solutions require confirmation number \
in RESTful message exchange.",
"multiValued": false,
"required": false,
"caseExact": false,
"mutability": "readWrite",
"returned": "default",
"uniqueness": "none"
}
],
"meta" : {
"resourceType" : "Schema",
"location" : "/v2/Schemas/urn:ietf:params:scim:schemas:\
extension:pairingOOB:2.0:Device"
}
}
]A.5. DPP Extension Schema 💖
Next up is the DPP one, the Wi-Fi Easy Connect / Device Provisioning Protocol schema. It's one object, no list, and it's so cute it's making me 😭
{
"id": "urn:ietf:params:scim:schemas:extension:dpp:2.0:Device",
"name": "dppExtension",
"description": "Device extension schema for Wi-Fi Easy \
Connect / Device Provisioning Protocol (DPP).",
"attributes" : [
{
"name": "dppVersion",
"type": "integer",
"description": "Version of DPP this device supports.",
"multiValued": false,
"required": true,
"caseExact": false,
"mutability": "readWrite",
"returned": "default",
"uniqueness": "none"
},
{
"name": "bootstrappingMethod",
"type": "string",
"description": "The list of all the bootstrapping methods \
available on the enrollee device, for example, [QR, NFC].",
"multiValued": true,
"required": false,
"caseExact": false,
"mutability": "readWrite",
"returned": "default",
"uniqueness": "none"
},
{
"name": "bootstrapKey",
"type": "string",
"description": "A base64-encoded Elliptic Curve Diffie-\
Hellman public key (may be P-256, P-384, or P-521).",
"multiValued": false,
"required": true,
"caseExact": true,
"mutability": "writeOnly",
"returned": "never",
"uniqueness": "none"
},
{
"name": "deviceMacAddress",
"type": "string",
"pattern": "^[0-9A-Fa-f]{2}(:[0-9A-Fa-f]{2}){5}$",
"description": "A unique public MAC address assigned by the \
manufacturer.",
"multiValued": false,
"required": false,
"caseExact": false,
"mutability": "readWrite",
"returned": "default",
"uniqueness": "Manufacturer"
},
{
"name": "classChannel",
"type": "string",
"description": "A list of global operating class and \
channel shared as bootstrapping information. It is formatted as \
class/channel, for example, '81/1', '115/36'.",
"multiValued": true,
"required": false,
"caseExact": false,
"mutability": "readWrite",
"returned": "default",
"uniqueness": "none"
},
{
"name": "serialNumber",
"type": "string",
"description": "An alphanumeric serial number that may also \
be passed as bootstrapping information.",
"multiValued": false,
"required": false,
"caseExact": false,
"mutability": "readWrite",
"returned": "default",
"uniqueness": "none"
}
],
"meta" : {
"resourceType" : "Schema",
"location" : "/v2/Schemas/urn:ietf:params:scim:schemas:\
extension:dpp:2.0:Device"
}
}A.6. Ethernet MAB Extension Schema 🎀
okay bestie, this one is the Ethernet MAB extension schema 🦋 It's a device extension for MAC Authentication Bypass, and it's literally just one attribute, deviceMacAddress, which is the MAC address the manufacturer assigned. ✨
{
"id": "urn:ietf:params:scim:schemas:extension:ethernet-mab:2.0:\
Device",
"name": "ethernetMabExtension",
"description": "Device extension schema for MAC Authentication \
Bypass.",
"attributes" : [
{
"name": "deviceMacAddress",
"type": "string",
"pattern": "^[0-9A-Fa-f]{2}(:[0-9A-Fa-f]{2}){5}$",
"description": "A MAC address assigned by the manufacturer.",
"multiValued": false,
"required": true,
"caseExact": false,
"mutability": "readWrite",
"returned": "default",
"uniqueness": "Manufacturer"
}
],
"meta" : {
"resourceType" : "Schema",
"location" : "/v2/Schemas/urn:ietf:params:scim:schemas:extension\
:ethernet-mab:2.0:Device"
}
}A.7. FDO Extension Schema 🌸
this one is for FIDO Device Onboard (FDO) 💜 It holds a single write-only attribute called fdoVoucher, which is a voucher as defined in the FDO specification. It's "returned": "never", so it's never handed back to anyone, which is very much giving secret keeper. 🤫
{
"id": "urn:ietf:params:scim:schemas:extension:fido-device-onboard:\
2.0:Device",
"name": "FDOExtension",
"description": "Device extension schema for FIDO Device Onboard (\
FDO).",
"attributes" : [
{
"name": "fdoVoucher",
"type": "string",
"description": "A voucher as defined in the FDO \
specification.",
"multiValued": false,
"required": true,
"caseExact": false,
"mutability": "writeOnly",
"returned": "never",
"uniqueness": "Manufacturer"
}
],
"meta" : {
"resourceType" : "Schema",
"location" : "/v2/Schemas/urn:ietf:params:scim:schemas:extension\
:fido-device-onboard:2.0:Device"
}
}A.8. Zigbee Extension Schema ⭐
now Zigbee 🐝 This schema has two attributes. The first is versionSupport, a multi-valued string listing every Zigbee version the device supports, for example [3.0]. The second is deviceEui64Address, which is the 64-bit Extended Unique Identifier (EUI-64) device address, written as eight colon-separated hex pairs. Both are required, so no skipping, bestie. 🙈
{
"id": "urn:ietf:params:scim:schemas:extension:zigbee:2.0:Device",
"name": "zigbeeExtension",
"description": "Device extension schema for Zigbee.",
"attributes" : [
{
"name": "versionSupport",
"type": "string",
"description": "Provides a list of all the Zigbee versions \
supported by the device, for example, [3.0].",
"multiValued": true,
"required": true,
"caseExact": false,
"mutability": "readWrite",
"returned": "default",
"uniqueness": "none"
},
{
"name": "deviceEui64Address",
"type": "string",
"pattern": "^[0-9A-Fa-f]{2}(:[0-9A-Fa-f]{2}){7}$",
"description": "The 64-bit Extended Unique Identifier \
(EUI-64) device address.",
"multiValued": false,
"required": true,
"caseExact": false,
"mutability": "readWrite",
"returned": "default",
"uniqueness": "none"
}
],
"meta" : {
"resourceType" : "Schema",
"location" : "/v2/Schemas/urn:ietf:params:scim:schemas:extension\
:zigbee:2.0:Device"
}
}A.9. endpointAppsExt Extension Schema 💅
this is the endpointAppsExt schema, and it's a whole vibe 👑 It's for partner endpoint applications that can onboard, control, and talk to the device. The applications attribute is a complex, multi-valued attribute with two sub-attributes: value (the identifier of the EndpointApp) and $ref (the URI of the EndpointApp that controls the device or pulls data from it). Then there are two enterprise endpoint URLs: deviceControlEnterpriseEndpoint, which is required, and telemetryEnterpriseEndpoint, which is optional. Iconic. 🫶
{
"id": "urn:ietf:params:scim:schemas:extension:endpointAppsExt:2.0:\
Device",
"name": "endpointAppsExt",
"description": "Extension for partner endpoint applications that \
can onboard, control, and communicate with the device.",
"attributes" : [
{
"name": "applications",
"type": "complex",
"description": "Includes references to two types of \
applications that connect with enterprise, i.e., deviceControl and \
telemetry.",
"multiValued": true,
"required": true,
"caseExact": false,
"mutability": "readWrite",
"returned": "default",
"uniqueness": "none",
"subAttributes" : [
{
"name" : "value",
"type" : "string",
"description" : "The identifier of the EndpointApp.",
"multiValued" : false,
"required" : true,
"caseExact" : false,
"mutability" : "readWrite",
"returned" : "default",
"uniqueness" : "none"
},
{
"name" : "$ref",
"type" : "reference",
"referenceTypes" : "EndpointApps",
"description" : "The URI of the corresponding EndpointApp\
resource that will control or obtain data from the device.",
"multiValued" : false,
"required" : true,
"caseExact" : true,
"mutability" : "readOnly",
"returned" : "default",
"uniqueness" : "none"
}
]
},
{
"name": "deviceControlEnterpriseEndpoint",
"type": "reference",
"description": "The URL of the enterprise endpoint that \
device control apps use to reach enterprise network gateway.",
"multiValued": false,
"required": true,
"caseExact": true,
"mutability": "readOnly",
"returned": "default",
"uniqueness": "Enterprise"
},
{
"name": "telemetryEnterpriseEndpoint",
"type": "reference",
"description": "The URL of the enterprise endpoint that \
telemetry apps use to reach enterprise network gateway.",
"multiValued": false,
"required": false,
"caseExact": true,
"mutability": "readOnly",
"returned": "default",
"uniqueness": "Enterprise"
}
],
"meta" : {
"resourceType" : "Schema",
"location" : "/v2/Schemas/urn:ietf:params:scim:schemas:extension\
:endpointAppsExt:2.0:Device"
}
}Appendix B. OpenAPI Representation 🌈
okay, now the OpenAPI stuff 🧚 Heads up: these sections are informational only, so they're extra helpful but they're not the official rules. ✨
B.1. Core Device Schema OpenAPI Representation 💖
here's the OpenAPI version of the core device schema. It defines the Group, Device, and CommonAttributes components, and it's a lot, so grab a snack 🍓
openapi: 3.1.0
info:
title: SCIM Device Schema
version: 1.0.0
components:
schemas:
Group:
type: object
description: A list of groups to which the device belongs,
either through direct membership, through nested
groups, or dynamically calculated.
properties:
value:
type: string
description: The unique identifier of a group,
typically a UUID.
readOnly: true
writeOnly: false
display:
type: string
description: A display string for the group.
readOnly: true
writeOnly: false
$ref:
type: string
format: uri
description: Reference to the group object.
readOnly: true
writeOnly: true
Device:
description: Entry containing attributes about a device.
type: object
properties:
displayName:
type: string
description: "Human-readable name of the device, suitable
for displaying to end users, for example,
'BLE Heart Monitor' etc."
readOnly: false
writeOnly: false
active:
type: boolean
description: A mutable boolean value indicating the device
administrative status. If true, the
commands (such as connect, disconnect,
subscribe) that control app sends to the
controller for the devices will be processed
by the controller. If false, any command
coming from the control app for the device
will be rejected by the controller.
readOnly: false
writeOnly: false
mudUrl:
type: string
format: uri
description: A URL to MUD file of the device (RFC 8520).
It is added for future use. Current usage is
not defined yet.
readOnly: false
writeOnly: false
groups:
type: array
description: List of groups to which a device belongs to.
items:
$ref: '#/components/schemas/Group'
required:
- active
additionalProperties: false
allOf:
- $ref: '#/components/schemas/CommonAttributes'
CommonAttributes:
type: object
properties:
schemas:
type: array
items:
type: string
enum:
- urn:ietf:params:scim:schemas:core:2.0:Device
description: The list of schemas that define the resource.
id:
type: string
format: uri
description: The unique identifier for a resource.
readOnly: true
writeOnly: false
externalId:
type: string
description: An identifier for the resource that is
defined by the provisioning client.
readOnly: false
writeOnly: false
meta:
type: object
readOnly: true
properties:
resourceType:
type: string
description: The name of the resource type of the
resource.
readOnly: true
writeOnly: false
location:
type: string
format: uri
description: The URI of the resource being returned.
readOnly: true
writeOnly: false
created:
type: string
format: date-time
description: The date and time the resource was added
to the service provider.
readOnly: true
writeOnly: false
lastModified:
type: string
format: date-time
description: The most recent date and time that the
details of this resource were updated at
the service provider.
readOnly: true
writeOnly: false
version:
type: string
description: The version of the resource.
readOnly: true
writeOnly: false
additionalProperties: falseB.2. EndpointApp Schema OpenAPI Representation ✨
okay so here's the OpenAPI version of the EndpointApp schema 🎀 this is the bit where the spec gets super literal, so every line counts. the code block is the source of truth, so read it closely 💅
openapi: 3.1.0
info:
title: SCIM Endpoint App Schema
version: 1.0.0
components:
schemas:
Group:
type: object
description: A list of groups to which the endpoint
application belongs, either through
direct membership, through nested
groups, or dynamically calculated.
properties:
value:
type: string
description: The unique identifier of a group,
typically a UUID.
readOnly: true
writeOnly: false
display:
type: string
description: A display string for the group.
readOnly: true
writeOnly: false
$ref:
type: string
format: uri
description: Reference to the group object.
readOnly: true
writeOnly: true
EndpointApp:
title: EndpointApp
description: Endpoint application resource.
type: object
properties:
applicationType:
type: string
description: This attribute will only contain two values:
deviceControl or telemetry.
readOnly: false
writeOnly: false
applicationName:
type: string
description: Human-readable name of the application.
readOnly: false
writeOnly: false
groups:
type: array
description: List of groups to which the EndpointApp
belongs.
items:
$ref: '#/components/schemas/Group'
required:
- applicationType
- applicationName
additionalProperties: true
oneOf:
- $ref: '#/components/schemas/clientToken'
- $ref: '#/components/schemas/certificateInfo'
allOf:
- $ref: '#/components/schemas/CommonAttributes'
clientToken:
type: string
description: "This attribute contains a token that the client
will use to authenticate itself. Each token may
be a string up to 500 characters in length."
readOnly: true
writeOnly: false
certificateInfo:
type: object
description: "Contains X.509 certificate's subject name and
root CA information associated with the device
control or telemetry app."
properties:
rootCA:
type: string
description: "The base64 encoding of a trust anchor
certificate, as per RFC 4648, Section 4."
readOnly: false
writeOnly: false
subjectName:
type: string
description: "Also known as the Common Name (CN), the
Subject Name is a field in the X.509
certificate that identifies the primary
domain or IP address for which the
certificate is issued."
readOnly: false
writeOnly: false
required:
- subjectName
CommonAttributes:
type: object
properties:
schemas:
type: array
items:
type: string
enum:
- urn:ietf:params:scim:schemas:core:2.0:EndpointApp
description: The list of schemas that define the resource.
id:
type: string
format: uri
description: The unique identifier for a resource.
readOnly: true
writeOnly: false
meta:
type: object
readOnly: true
properties:
resourceType:
type: string
description: The name of the resource type of the
resource.
readOnly: true
writeOnly: false
location:
type: string
format: uri
description: The URI of the resource being returned.
readOnly: true
writeOnly: false
created:
type: string
format: date-time
description: The date and time the resource was added
to the service provider.
readOnly: true
writeOnly: false
lastModified:
type: string
format: date-time
description: The most recent date and time that the
details of this resource were updated at
the service provider.
readOnly: true
writeOnly: false
version:
type: string
description: The version of the resource.
readOnly: true
writeOnly: false
additionalProperties: falseB.3. BLE Extension Schema OpenAPI Representation 🦋
next up is the BLE extension schema in OpenAPI form 💜 there's a lot of pairing stuff in here, so take your time and don't skip the fine print. the bits about the MAC address format and the key patterns are super specific, bestie 🔥
openapi: 3.1.0
info:
title: SCIM Bluetooth Extension Schema
version: 1.0.0
components:
schemas:
BleDevice:
type: object
description: BLE device schema.
properties:
schemas:
type: array
items:
type: string
enum:
- urn:ietf:params:scim:schemas:extension:ble:2.0
:Device
urn:ietf:params:scim:schemas:extension:ble:2.0:Device:
$ref: '#/components/schemas/BleDeviceExtension'
required: true
BleDeviceExtension:
type: object
properties:
versionSupport:
type: array
items:
type: string
description: Provides a list of all the BLE versions
supported by the device, for example,
[4.1, 4.2, 5.0, 5.1, 5.2, 5.4].
readOnly: false
writeOnly: false
deviceMacAddress:
type: string
description: It is the public MAC address assigned by the
manufacturer. It is a unique 48-bit value. The
regex pattern is
^[0-9A-Fa-f]{2}(:[0-9A-Fa-f]{2}){5}.
readOnly: false
writeOnly: false
isRandom:
type: boolean
description: AddressType flag is taken from the BLE core
specifications 5.4. If false, the device is
using a public MAC address. If true, device
is using a random address.
readOnly: false
writeOnly: false
separateBroadcastAddress:
type: string
description: "When present, this address is used for
broadcasts/advertisements. This value
MUST NOT be set when an IRK is provided.
Its form is the same as deviceMacAddress."
readOnly: false
writeOnly: false
irk:
type: string
description: Identity Resolving Key (IRK), which is unique
for every device. It is used to resolve a
random address.
readOnly: false
writeOnly: true
mobility:
type: boolean
description: If set to true, the BLE device will
automatically connect to the closest AP. For
example, if a BLE device is connected with
AP-1 and moves out of range but comes in
range of AP-2, it will be disconnected with
AP-1 and connected with AP-2.
readOnly: false
writeOnly: false
pairingMethods:
type: array
items:
type: string
description: List of pairing methods associated with the
BLE device, stored as schema URI.
readOnly: false
writeOnly: false
urn:ietf:params:scim:schemas:extension:pairingNull:2.0
:Device:
$ref: '#/components/schemas/NullPairing'
required: false
urn:ietf:params:scim:schemas:extension:pairingJustWorks:2.0
:Device:
$ref: '#/components/schemas/PairingJustWorks'
required: false
urn:ietf:params:scim:schemas:extension:pairingPassKey:2.0
:Device:
$ref: '#/components/schemas/PairingPassKey'
required: false
urn:ietf:params:scim:schemas:extension:pairingOOB:2.0
:Device:
$ref: '#/components/schemas/PairingOOB'
required: false
required:
- versionSupport
- deviceMacAddress
- AddressType
- pairingMethods
additionalProperties: false
NullPairing:
type: object
PairingJustWorks:
type: object
description: Just Works pairing method for BLE.
properties:
key:
type: integer
description: Just Works does not have any key value. For
completeness, it is added with a key value
'null'.
readOnly: false
writeOnly: false
required:
- key
PairingPassKey:
type: object
description: Passkey pairing method for BLE.
properties:
key:
type: integer
description: A six-digit passkey for a BLE device.
The pattern of key is ^[0-9]{6}$.
readOnly: false
writeOnly: true
required:
- key
PairingOOB:
type: object
description: Out-of-band pairing method for BLE.
properties:
key:
type: string
description: The OOB key value for a BLE device.
readOnly: false
writeOnly: false
randomNumber:
type: integer
description: Nonce added to the key.
readOnly: false
writeOnly: true
confirmationNumber:
type: integer
description: Some solutions require a confirmation number
in the RESTful message exchange.
readOnly: false
writeOnly: true
required:
- key
- randomNumberB.4. DPP Extension Schema OpenAPI Representation ✨
okay so here's the OpenAPI version of the DPP extension schema 🎀 it's the Wi-Fi Easy Connect one, and it's giving very organized energy 💅
openapi: 3.1.0
info:
title: SCIM Device Provisioning Protocol Extension Schema
version: 1.0.0
components:
schemas:
DppDevice:
type: object
description: Wi-Fi Easy Connect (DPP) device extension schema.
properties:
schemas:
type: array
items:
type: string
enum:
- urn:ietf:params:scim:schemas:extension:dpp:2.0
:Device
urn:ietf:params:scim:schemas:extension:dpp:2.0:Device:
$ref: '#/components/schemas/DppDeviceExtension'
required: true
DppDeviceExtension:
type: object
properties:
dppVersion:
type: integer
description: Version of DPP this device supports.
readOnly: false
writeOnly: false
bootstrappingMethod:
type: array
items:
type: string
description: The list of all the bootstrapping methods
available on the enrollee device, for
example, [QR, NFC].
readOnly: false
writeOnly: false
bootstrapKey:
type: string
description: An Elliptic Curve Diffie-Hellman
(ECDH) public key. The base64-encoded length
for P-256, P-384, and P-521 is 80, 96, and
120 characters.
readOnly: false
writeOnly: true
deviceMacAddress:
type: string
description: The MAC address assigned by the manufacturer.
The regex pattern is
^[0-9A-Fa-f]{2}(:[0-9A-Fa-f]{2}){5}.
readOnly: false
writeOnly: false
classChannel:
type: array
items:
type: string
description: A list of global operating class and channel
shared as bootstrapping information. It is
formatted as class/channel, for example,
'81/1', '115/36'.
readOnly: false
writeOnly: false
serialNumber:
type: string
description: An alphanumeric serial number that may also
be passed as bootstrapping information.
readOnly: false
writeOnly: false
required:
- dppVersion
- bootstrapKey
additionalProperties: falseB.5. Ethernet MAB Extension Schema OpenAPI Representation 🦋
next up is the Ethernet MAB one (MAC Authentication Bypass, for the Ethernet side of things) 🌸 here's how it looks in OpenAPI
openapi: 3.1.0
info:
title: SCIM MAC Authentication Bypass Extension Schema
version: 1.0.0
components:
schemas:
EthernetMABDevice:
type: object
description: Ethernet MAC Authenticated Bypass.
properties:
schemas:
type: array
items:
type: string
enum:
- urn:ietf:params:scim:schemas:extension:ethernet-mab
:2.0:Device
urn:ietf:params:scim:schemas:extension:ethernet-mab:2.0
:Device:
$ref: '#/components/schemas/EthernetMABDeviceExtension'
required: true
EthernetMABDeviceExtension:
type: object
properties:
deviceMacAddress:
type: string
description: It is the public MAC address assigned by the
manufacturer. It is a unique 48-bit value.
The regex pattern is
^[0-9A-Fa-f]{2}(:[0-9A-Fa-f]{2}){5}.
readOnly: false
writeOnly: false
required:
- deviceMacAddress
description: Device extension schema for Ethernet-MAB.B.6. FDO Extension Schema OpenAPI Representation 🧚
now the FDO one, which is FIDO Device Onboarding 💜 it's got a voucher, so it's lowkey a whole vibe 🎟️
openapi: 3.1.0
info:
title: SCIM FIDO Device Onboarding Extension Schema
version: 1.0.0
components:
schemas:
FDODevice:
type: object
description: FIDO Device Onboarding (FDO) extension.
properties:
schemas:
type: array
items:
type: string
enum:
- urn:ietf:params:scim:schemas:extension:fido-device
-onboard:2.0:Device
urn:ietf:params:scim:schemas:extension:fido-device-onboard
:2.0:Device:
$ref: '#/components/schemas/FDODeviceExtension'
required: true
FDODeviceExtension:
type: object
properties:
fdoVoucher:
type: string
description: A FIDO Device Onboard (FDO) voucher.
readOnly: false
writeOnly: false
required:
- fdoVoucher
description: Device extension for a FIDO Device Onboard (FDO).B.7. Zigbee Extension Schema OpenAPI Representation 🍓
Zigbee's next, and it's serving versions and EUI-64 addresses, iykyk 🐝✨
openapi: 3.1.0
info:
title: SCIM Zigbee Extension Schema
version: 1.0.0
components:
schemas:
ZigbeeDevice:
type: object
description: Zigbee device schema.
properties:
schemas:
type: array
items:
type: string
enum:
- urn:ietf:params:scim:schemas:extension:zigbee:2.0
:Device
urn:ietf:params:scim:schemas:extension:zigbee:2.0:Device:
$ref: '#/components/schemas/ZigbeeDeviceExtension'
required: true
ZigbeeDeviceExtension:
type: object
properties:
versionSupport:
type: array
items:
type: string
description: Provides a list of all the Zigbee versions
supported by the device, for example, [3.0].
readOnly: false
writeOnly: false
deviceEui64Address:
type: string
description: The 64-bit Extended Unique Identifier (EUI-64)
device address. The regex pattern is
^[0-9A-Fa-f]{16}$.
readOnly: false
writeOnly: false
required:
- versionSupport
- deviceEui64Address
description: Device extension schema for Zigbee.B.8. endpointAppsExt Extension Schema OpenAPI Representation 💖
last one in this bit is endpointAppsExt, and it's the main character of the endpoint stuff 👑 it links up to the EndpointApp resources, so it's very connected bestie 🫶
openapi: 3.1.0
info:
title: SCIM Endpoint Extension Schema
version: 1.0.0
components:
schemas:
EndpointAppsExt:
type: object
properties:
applications:
$ref: '#/components/schemas/applications'
deviceControlEnterpriseEndpoint:
type: string
format: url
description: The URL of the enterprise endpoint that
device control apps use to reach an
enterprise network gateway.
readOnly: true
writeOnly: false
telemetryEnterpriseEndpoint:
type: string
format: url
description: The URL of the enterprise endpoint that
telemetry apps use to reach an enterprise
network gateway.
readOnly: true
writeOnly: false
required:
- applications
- deviceControlEnterpriseEndpoint
applications:
type: array
items:
value:
type: string
description: The identifier of the EndpointApp.
readOnly: false
writeOnly: false
ref:
type: string
format: uri
description: The URI of the corresponding EndpointApp
resource that will control or obtain data
from the device.
readOnly: true
writeOnly: false
required:
- value
- refAppendix C. FIDO Device Onboarding Example Flow 🦋
okay so bestie, this is the part where the spec finally shows you the whole story in pictures 🎀 these diagrams show how FDO can be used. in the first one, a device gets onboarded to the device owner process AND to the AAA server for its initial onboarding 💖 the voucher holds a device certificate, and the AAA system uses that certificate to authenticate the device ✨
,------. ,------. ,-------.
|SCIM | |SCIM | |Owner | ,---.
|Client| |Server| |Service| |AAA|
`---+--' `---+--' `---+---' `-+-'
,------------------------------!. | |
|Voucher contains |_\ | |
|an X.509 cert chain | | |
`--------------------------------' | |
|1 POST [FDO(voucher)] | | |
|/HTTP | | |
|--------------------->| | |
| | | |
| |----. | |
| | | 2 Recover X.509 | |
| |<---' cert chain | |
| | from voucher | |
| | | |
| | | |
| |3 Add device(voucher) | |
| |/HTTP | |
| |--------------------->| |
| | | |
| | 4 200 "ok" | |
| |<---------------------| |
| | | |
| | 5 Add identity |
| |------------------------------->|
| | | |
| | 6 200 "ok" |
| |<-------------------------------|
| | | |
| 7 200 "ok" | | |
|<---------------------| | |
| | | |
| | | |once this flow is complete, the device can first provisionally onboard and then later get a trust anchor through FDO's Transfer Ownership Protocol 2 (TO2) process 🌸 here's how that looks ✨
,-------. ,------.
|Owner | ,---. |Access| ,------.
|Service| |AAA| |Point | |Device|
`---+---' `-+-' `---+--' `---+--'
| | | ,------------------!.
| | | |Device configured |_\
| | | |with well-known |
| | | |RCOI and for trust |
| | | |on first use |
| | | `--------------------'
| | ,---------------!. |
| | |WLAN configured|_\ |
| | |with well-known | |
| | |RCOI | |
| | `-----------------' |
| | | 1 EAP-TLS/EAPOL |
| | |<-----------------|
| | | |
| |2 EAP-TLS/Radius | |
| |<----------------| |
| | | |
| | ,--------------------------!.
| | |Device skips |_\
| | |server authentication |
| | `----------------------------'
| |3 Result=Success | |
| |---------------->| |
| | | |
| ,-----------------------!. |
| |Limited access |_\ |
| |for now | |
| `-------------------------' |
| | |4 Result=Success |
| | |----------------->|
| | | |
| | 5 FDO TO2 | |
|<----------------------------------------------------|
| | | |
,-------------------------------------------------------------!.
|FSIM, Runtime SSID, |_\
|Credentials incl. |
|local trust anchor |
`---------------------------------------------------------------'
| | | 6 dissasociate |
| | |<-----------------|
| | | |
| | |7 EAP-TLS w/ LSC |
| | |<-----------------|
| | | |
| | | |
. . etc . .Acknowledgments 🫶
the authors want to thank Sriram Sekar, Bart Brinckman, Rohit Mohan, Lars Streubesand, Christian Amsüss, Jason Livingwood, Mike Ounsworth, Monty Wiseman, Geoffrey Cooper, Paulo Jorge N. Correia, Phil Hunt, and Elwyn Davies for their reviews 💅 and Nick Ross for his contribution to the appendix 👑 absolute legends, all of you 🌈
Authors' Addresses 💜
Muhammad Shahzad North Carolina State University Department of Computer Science 890 Oval Drive Campus Box 8206 Raleigh, NC 27695-8206 United States of America Email: mshahza@ncsu.edu
Hassan Iqbal North Carolina State University Department of Computer Science 890 Oval Drive Campus Box 8206 Raleigh, NC 27695-8206 United States of America Email: hassaniqbal931@gmail.com
Eliot Lear Cisco Systems Richtistrasse 7 CH-8304 Wallisellen Switzerland Phone: +41 44 878 9200 Email: lear@cisco.com
📦 where this page comes from
- ietf: rfc9944 2026-05
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms