mozilla-services/msisdn-gateway — pull request #46 by ckarlof (2014-05-22 01:20:23+00:00)
Title: ckarlof api change proposal

Based on what we discussed on the morning of 5-21-14.

Notes:
* I removed the `/sms/mt/resend` endpoint. It seems that to resend the client can call `/sms/mt/verify` again with the same MSISDN (see below question)
* I removed the HTTP endpoint `/sms/momt/verify` endpoint, as I was suggesting this morning. As an alternative, I defined the SMS endpoint `/sms/momt/verify` to include the HKDF derived Hawk credential `id`, which is not intended to be secret, but is just used to identify the Hawk credentials. This will allow the server to bind the client's MSISDN to the appropriate session and do the right thing when the client later calls `/sms/verify_code`. I think this enables us to remove the extra HTTP endpoint without any compromises to security. Thoughts? I think it's a win, but if there is sufficient resistance, we can go back to the HTTP `/sms/momt/verify` endpoint.
* I removed the network and telephony endpoints since we're not implementing them at this time.

Questions:
* Should `/discovery` indicate a preferred verification method?
* What does `/sms/mt/verify` return if a client calls it twice and the second MSISDN differs from the first one given? I think that should be an error. Thoughts?