Operation to get qos-profiles for a device MUST use a verb and needs a security object

[hdamker]

Problem description

The POST operation qosProfilesDevice in qos-profiles does not create a resource but retrieves an array of qosProfile.
According to https://github.com/camaraproject/Commonalities/blob/main/documentation/API-design-guidelines.md#post-or-get-for-transferring-sensitive-or-complex-data the resource in the path MUST be a verb (e.g. retrieve-qos-profiles, see additional context).

Expected behavior

1. Rename the resource within the path of qosProfilesDevice operation with a verb, proposal is retrieve-qos-profiles and adapt the operationId accordingly, e.g. retrieveQoSProfilesByDevice
2. Add an appropriate security requirements object, with the scope name according to https://github.com/camaraproject/Commonalities/blob/main/documentation/API-design-guidelines.md#1161-scope-naming

      security:
        - openId:
            - qos-profiles:<verb>

Alternative solution

Additional context

Compare with comments #325 (comment)
We have retrieve-sessions and retrieve-device-qos, so retrieve-qos-profiles makes most sense.

[hdamker]

@RandyLevensalor

[RandyLevensalor]

I can create a PR to address this.