zeta: Client Assertion replaces RAT, v1.3.1; api-vzd: KIM certificate; testhub: 27 tags

api-vzd

159 new commits on main, 476 on develop. Changes:

• KIM: new appTags and payloadType for KIM endpoint examples; new extension EndpointCertificateEx for X.509 certificates in the endpoint (branch kim-cert).
• Search: new optional parameters specialty and characteristics, additional runtime hints for near-searches; notes on reserved characters in full-text search added.
• Error handling: HTTP error 423 (locking) removed from the specification.
• New branch 1.2.0: introduces the code system value sonderoeffnung in OpeningTimeQualifierCS (special opening hours).
• New branch khvzd: KHVZ HealthcareService profiles for hospital structures (location, facility, center, department) and search parameters for offered-in.
• Updates to documentation and PlantUML diagrams (location directory, LDAP2FHIR sync, FHIR-VZD HOWTOs).
• New releases: I_Directory_Administration/1.12.8, I_Directory_Application_Maintenance/1.4.8, VZD_FHIR/1.2.0-17, gemILF_Pflege_VZD/1.5.17.
• Deleted branches: feature/TelematikID, feature/kim-dienstkennungCS, one Dependabot branch.

app-gemSekIdp

• New releases: 8.4.1 and 8.4.2 merged into main.
• The publishInternalRelease-* branches 40 through 64 were deleted.

ti2.0-testhub

• main: releases from version 1.1.9 to 3.13.0 (27 releases, 54 commits, about 935 changed files). The commit messages read "Release X" or "Publish Release X".
• New tags: 1.1.9 – 1.1.15, 2.0.0 – 2.5.0, 3.0.0 – 3.13.0 (27 in total).

zeta

Changes around "ZETA Stufe 2":

• Registration flow: Registration Access Token (RAT) replaced by Client Assertion; recovery code generation and definition removed from the DCR request schema and flow diagrams.
• Policy engine input schema: amr → acr, aud → audience (required field), client_assertion objects removed, structure of authorization_request revised; refresh_token removed from the token response schema.
• Email OTP: new schemas and a new flow for sending the OTP separately by email after the OIDC flow; separate scopes depending on device binding status.
• Token handling: DPoP proof request extended with required fields, token request with grant_type, resource and scope, token revocation flow revised; revocation_endpoint is a required field in .well-known.
• Trust chain: new trust chain for the ZETA Guard provisioning container due to a change of intermediate certificates (branch at/new-provisioning-container-ca-chain, tag provcontainer-fe79244e0d73).
• Revised diagrams: notification service, token exchange, token revocation, ZETA Guard deployment with a new proxy component.
• New releases: v1.3.0, v1.3.1, v1.3.1-1, v1.3.1-2.
• New branches for user manual 1.2.0/1.2.1, disclaimer update, name correction of the policy repo, and provisioning container fixes for PU.
• Deleted branches: feature/zeta-1-26-2, feature/zeta-stufe1-26-1, MS2_Draft, older user manual branches.

At a glance

• zeta: "ZETA Stufe 2" changes DCR (Client Assertion instead of RAT, no recovery code) and the policy engine schema (amr→acr, aud→audience); new releases v1.3.0, v1.3.1, v1.3.1-1, v1.3.1-2.
• zeta: New trust chain for the ZETA Guard provisioning container due to a change of intermediate certificates.
• api-vzd: KIM endpoints with EndpointCertificateEx and appTags; code sonderoeffnung in branch 1.2.0; KHVZ HealthcareService profiles in branch khvzd.
• ti2.0-testhub: 27 new tags on main (1.1.9 to 3.13.0), 54 commits, about 935 changed files.
• app-gemSekIdp: New releases 8.4.1 and 8.4.2; publishInternalRelease-* branches 40 through 64 deleted.