Update API-design-guidelines for subscription

[bigludo7]

What type of PR is this?

Add one of the following kinds:

• enhancement/feature

What this PR does / why we need it:

Reformulate the subscription part to align with our decision to move to CloudsEvent subscription model. This PR is aligned with the PR #189 which provide an examples.

Which issue(s) this PR fixes:

Fixes #185 #153 #149 #140

Special notes for reviewers:

Changelog input

 release-note
- Move to cloudsEvents subscription model
- Add `initialevent` management
- Add draft subscription status management

Additional documentation

This section can be blank.

docs

[AxelNennker]

sinkCredential is not explained enough.
Is it a shared secret provided by the API consumer?
Do we enforce that the shared secret is different and random enough for each subscription?

Is the sinkCredential a signed and encrypted JWT? With an aud of sink?
What is the value of source? Is it the value of issuerthe the AZ metadata? Or is the source maybe API specific (and the event still have different types for the same API?

[AxelNennker]

I changed my mind about ACCESSTOKEN. There is not much Camara can do on enforcing security at the API consumer.
Somebody can please resolve the conversations. @shilpa-padgaonkar

[bigludo7]

Rename webhook to sink for implicit subscription + accepted @PedroDiez proposals + proposal for token expiration

[bigludo7]

I changed my mind about ACCESSTOKEN. There is not much Camara can do on enforcing security at the API consumer. Somebody can please resolve the conversations. @shilpa-padgaonkar

Thanks @AxelNennker
@PedroDiez I can close this point?

[AxelNennker]

• phoneNumber format should be "corrrect" (if needed at all, better use sub)
• add Authorization Header

[PedroDiez]

Need to think about Access Token Expiration. Get your view @bigludo7

Several editorial comments. The whole view looks fine to me

[bigludo7]

@shilpa-padgaonkar @AxelNennker I've accepted your proposal + changed the sentence line 1404.

[shilpa-padgaonkar]

@bigludo7 Thanks. There is another very small fix already proposed as suggestion in this comment by Axel #198 (comment) which will fix the missing authZ header in one of the examples.
After that its /LGTM :)

[bigludo7]

Thanks @shilpa-padgaonkar for the pointer on @AxelNennker comment.
Commited!

[shilpa-padgaonkar]

/LGTM

[shilpa-padgaonkar]

@bigludo7 I noticed that there is a minor conflict you would need to resolve in the file which is blocking the merge. If you could kindly do this, we would go ahead and merge this PR as we have enough approvals now :)

[bigludo7]

@bigludo7 I noticed that there is a minor conflict you would need to resolve in the file which is blocking the merge. If you could kindly do this, we would go ahead and merge this PR as we have enough approvals now :)

Thanks @shilpa-padgaonkar. Hope to have fixed it.

[shilpa-padgaonkar]

/LGTM