generated: '2026-07-25'
method: derived
source: operation-level security[] requirements across openapi/gsma-open-gateway-*.yml
note: 'Every Open Gateway specification declares a single openIdConnect security scheme named ''openId'' and attaches
  CAMARA scopes per operation, so the scopes are not listed in a flows map and 0-working/derive-oauth-scopes.py
  (which reads oauth2 flows) returns nothing for this provider. The 30 scopes below were derived from the per-operation
  security requirements. The GSMA issues no tokens and publishes no scope reference page of its own: the authorization
  server is always the operator''s, and the openIdConnectUrl in every published spec is the CAMARA placeholder https://example.com/.well-known/openid-configuration.
  Scope naming follows the CAMARA convention <api-name>:[<resource>:]<action>.'
model: openIdConnect (OpenID Connect Core) — not an OAuth 2.0 flows map
schemes:
- name: openId
  type: openIdConnect
  openIdConnectUrl: https://example.com/.well-known/openid-configuration (CAMARA placeholder)
  sources:
  - openapi/gsma-open-gateway-call-forwarding-signal-openapi.yml
  - openapi/gsma-open-gateway-carrier-billing-openapi.yml
  - openapi/gsma-open-gateway-carrier-billing-refund-openapi.yml
  - openapi/gsma-open-gateway-device-identifier-openapi.yml
  - openapi/gsma-open-gateway-device-location-retrieval-openapi.yml
  - openapi/gsma-open-gateway-device-location-verification-openapi.yml
  - openapi/gsma-open-gateway-device-reachability-status-openapi.yml
  - openapi/gsma-open-gateway-device-roaming-status-openapi.yml
  - openapi/gsma-open-gateway-device-swap-openapi.yml
  - openapi/gsma-open-gateway-home-devices-quality-on-demand-openapi.yml
  - openapi/gsma-open-gateway-know-your-customer-openapi.yml
  - openapi/gsma-open-gateway-number-verification-openapi.yml
  - openapi/gsma-open-gateway-otp-validation-openapi.yml
  - openapi/gsma-open-gateway-population-density-data-openapi.yml
  - openapi/gsma-open-gateway-quality-on-demand-openapi.yml
  - openapi/gsma-open-gateway-simple-edge-discovery-openapi.yml
scope_count: 30
scopes:
- scope: call-forwarding-signal:call-forwardings:read
  scheme: openId
  operations:
  - openapi/gsma-open-gateway-call-forwarding-signal-openapi.yml#retrieveCallForwarding
  sources:
  - openapi/gsma-open-gateway-call-forwarding-signal-openapi.yml
- scope: call-forwarding-signal:unconditional-call-forwardings:read
  scheme: openId
  operations:
  - openapi/gsma-open-gateway-call-forwarding-signal-openapi.yml#retrieveUnconditionalCallForwarding
  sources:
  - openapi/gsma-open-gateway-call-forwarding-signal-openapi.yml
- scope: carrier-billing-refund:refunds:create
  scheme: openId
  operations:
  - openapi/gsma-open-gateway-carrier-billing-refund-openapi.yml#createRefund
  sources:
  - openapi/gsma-open-gateway-carrier-billing-refund-openapi.yml
- scope: carrier-billing-refund:refunds:read
  scheme: openId
  operations:
  - openapi/gsma-open-gateway-carrier-billing-refund-openapi.yml#retrievePaymentRemainingAmount
  - openapi/gsma-open-gateway-carrier-billing-refund-openapi.yml#retrieveRefund
  - openapi/gsma-open-gateway-carrier-billing-refund-openapi.yml#retrieveRefunds
  sources:
  - openapi/gsma-open-gateway-carrier-billing-refund-openapi.yml
- scope: carrier-billing:payments:create
  scheme: openId
  operations:
  - openapi/gsma-open-gateway-carrier-billing-openapi.yml#createPayment
  - openapi/gsma-open-gateway-carrier-billing-openapi.yml#preparePayment
  sources:
  - openapi/gsma-open-gateway-carrier-billing-openapi.yml
- scope: carrier-billing:payments:read
  scheme: openId
  operations:
  - openapi/gsma-open-gateway-carrier-billing-openapi.yml#retrievePayment
  - openapi/gsma-open-gateway-carrier-billing-openapi.yml#retrievePayments
  sources:
  - openapi/gsma-open-gateway-carrier-billing-openapi.yml
- scope: carrier-billing:payments:write
  scheme: openId
  operations:
  - openapi/gsma-open-gateway-carrier-billing-openapi.yml#cancelPayment
  - openapi/gsma-open-gateway-carrier-billing-openapi.yml#confirmPayment
  - openapi/gsma-open-gateway-carrier-billing-openapi.yml#validatePayment
  sources:
  - openapi/gsma-open-gateway-carrier-billing-openapi.yml
- scope: device-identifier:retrieve-identifier
  scheme: openId
  operations:
  - openapi/gsma-open-gateway-device-identifier-openapi.yml#retrieveIdentifier
  sources:
  - openapi/gsma-open-gateway-device-identifier-openapi.yml
- scope: device-identifier:retrieve-type
  scheme: openId
  operations:
  - openapi/gsma-open-gateway-device-identifier-openapi.yml#retrieveType
  sources:
  - openapi/gsma-open-gateway-device-identifier-openapi.yml
- scope: device-reachability-status:read
  scheme: openId
  operations:
  - openapi/gsma-open-gateway-device-reachability-status-openapi.yml#getReachabilityStatus
  sources:
  - openapi/gsma-open-gateway-device-reachability-status-openapi.yml
- scope: device-roaming-status:read
  scheme: openId
  operations:
  - openapi/gsma-open-gateway-device-roaming-status-openapi.yml#getRoamingStatus
  sources:
  - openapi/gsma-open-gateway-device-roaming-status-openapi.yml
- scope: device-swap
  scheme: openId
  operations:
  - openapi/gsma-open-gateway-device-swap-openapi.yml#checkDeviceSwap
  - openapi/gsma-open-gateway-device-swap-openapi.yml#retrieveDeviceSwapDate
  sources:
  - openapi/gsma-open-gateway-device-swap-openapi.yml
- scope: device-swap:check
  scheme: openId
  operations:
  - openapi/gsma-open-gateway-device-swap-openapi.yml#checkDeviceSwap
  sources:
  - openapi/gsma-open-gateway-device-swap-openapi.yml
- scope: device-swap:retrieve-date
  scheme: openId
  operations:
  - openapi/gsma-open-gateway-device-swap-openapi.yml#retrieveDeviceSwapDate
  sources:
  - openapi/gsma-open-gateway-device-swap-openapi.yml
- scope: kyc-match:match
  scheme: openId
  operations:
  - openapi/gsma-open-gateway-know-your-customer-openapi.yml#KYC_Match
  sources:
  - openapi/gsma-open-gateway-know-your-customer-openapi.yml
- scope: location-retrieval:read
  scheme: openId
  operations:
  - openapi/gsma-open-gateway-device-location-retrieval-openapi.yml#retrieveLocation
  sources:
  - openapi/gsma-open-gateway-device-location-retrieval-openapi.yml
- scope: location-verification:verify
  scheme: openId
  operations:
  - openapi/gsma-open-gateway-device-location-verification-openapi.yml#verifyLocation
  sources:
  - openapi/gsma-open-gateway-device-location-verification-openapi.yml
- scope: number-verification:device-phone-number:read
  scheme: openId
  operations:
  - openapi/gsma-open-gateway-number-verification-openapi.yml#phoneNumberShare
  sources:
  - openapi/gsma-open-gateway-number-verification-openapi.yml
- scope: number-verification:verify
  scheme: openId
  operations:
  - openapi/gsma-open-gateway-number-verification-openapi.yml#phoneNumberVerify
  sources:
  - openapi/gsma-open-gateway-number-verification-openapi.yml
- scope: one-time-password-sms:send-validate
  scheme: openId
  operations:
  - openapi/gsma-open-gateway-otp-validation-openapi.yml#sendCode
  - openapi/gsma-open-gateway-otp-validation-openapi.yml#validateCode
  sources:
  - openapi/gsma-open-gateway-otp-validation-openapi.yml
- scope: population-density-data:read
  scheme: openId
  operations:
  - openapi/gsma-open-gateway-population-density-data-openapi.yml#retrievePopulationDensity
  sources:
  - openapi/gsma-open-gateway-population-density-data-openapi.yml
- scope: quality-on-demand:sessions:create
  scheme: openId
  operations:
  - openapi/gsma-open-gateway-quality-on-demand-openapi.yml#createSession
  sources:
  - openapi/gsma-open-gateway-quality-on-demand-openapi.yml
- scope: quality-on-demand:sessions:delete
  scheme: openId
  operations:
  - openapi/gsma-open-gateway-quality-on-demand-openapi.yml#deleteSession
  sources:
  - openapi/gsma-open-gateway-quality-on-demand-openapi.yml
- scope: quality-on-demand:sessions:read
  scheme: openId
  operations:
  - openapi/gsma-open-gateway-quality-on-demand-openapi.yml#getSession
  sources:
  - openapi/gsma-open-gateway-quality-on-demand-openapi.yml
- scope: quality-on-demand:sessions:retrieve-by-device
  scheme: openId
  operations:
  - openapi/gsma-open-gateway-quality-on-demand-openapi.yml#retrieveSessionsByDevice
  sources:
  - openapi/gsma-open-gateway-quality-on-demand-openapi.yml
- scope: quality-on-demand:sessions:update
  scheme: openId
  operations:
  - openapi/gsma-open-gateway-quality-on-demand-openapi.yml#extendQosSessionDuration
  sources:
  - openapi/gsma-open-gateway-quality-on-demand-openapi.yml
- scope: sim-swap
  scheme: openId
  operations:
  - openapi/gsma-open-gateway-sim-swap-openapi.yml#checkSimSwap
  - openapi/gsma-open-gateway-sim-swap-openapi.yml#retrieveSimSwapDate
  sources:
  - openapi/gsma-open-gateway-sim-swap-openapi.yml
- scope: sim-swap:check
  scheme: openId
  operations:
  - openapi/gsma-open-gateway-sim-swap-openapi.yml#checkSimSwap
  sources:
  - openapi/gsma-open-gateway-sim-swap-openapi.yml
- scope: sim-swap:retrieve-date
  scheme: openId
  operations:
  - openapi/gsma-open-gateway-sim-swap-openapi.yml#retrieveSimSwapDate
  sources:
  - openapi/gsma-open-gateway-sim-swap-openapi.yml
- scope: simple-edge-discovery:edge-cloud-zones:read
  scheme: openId
  operations:
  - openapi/gsma-open-gateway-simple-edge-discovery-openapi.yml#readClosestEdgeCloudZone
  sources:
  - openapi/gsma-open-gateway-simple-edge-discovery-openapi.yml