[YadingFang]

What type of PR is this?

• correction
• documentation
• tests

What this PR does / why we need it:

Close the remaining Commonalities r4.4 implicit-callback gaps before the Sync26 public release: accepted sink URLs were not returned, and callback security required Bearer authentication even though sinkCredential is optional.

Changes

• Add optional Call.sink and echo accepted sinks in POST /calls (201) and GET /calls/{callId}; never return credential secrets.
• Support HTTPS callbacks with or without Bearer authentication. The POST /calls OAuth requirements remain unchanged.
• Add required callback responses 410 and 429 (Event Guide §3.5); retain the existing 2XX success response, including 204.
• Extend Gherkin scenarios for authenticated/unauthenticated callbacks, no-sink creation, sink echo and secret non-disclosure.
• Clarify callback security and accessTokenExpiresUtc relative to the call lifetime; refresh expired token-expiry examples.

Which issue(s) this PR fixes:

N/A

Special notes for reviewers:

The shared r4.4 AccessTokenCredential.accessTokenExpiresUtc description still uses explicit-subscription wording. CTD now documents the implicit call-lifetime rule locally without changing synced common schemas; whether this fully meets §3.4's attribute-level wording requirement may need upstream confirmation.

Changelog input

Align implicit callbacks with Commonalities r4.4: echo registered sinks, support optional callback authentication, add required 410/429 responses, and update tests and documentation.

[camara-validation]

CAMARA Validation — PASS

0 errors, 0 warnings, 0 hints | Profile: standard

View full results

[Wojiaozhenghao]

ok