CIBA in NR is problematic

code/API_definitions/number-recycling.yaml

@@ -59,6 +59,14 @@
     In cases where personal data is processed by the API and users can exercise their rights through mechanisms such as opt-in and/or opt-out, the use of three-legged access tokens is mandatory. This ensures that the API remains in compliance with privacy regulations, upholding the principles of transparency and user-centric privacy-by-design.
     <!-- CAMARA:MANDATORY:authorization-and-authentication:END -->
 
+    Note: Using CIBA to obtain an access token for this API is problematic, because CIBA
+    delivers an authentication challenge (e.g. a push notification or SMS) to the device
+    associated with the phone number. This conflicts with the API's purpose: checking
+    whether that phone number still belongs to the same subscriber who originally consented.
+    If the number has since been recycled, the authentication challenge is delivered to the
+    new subscriber rather than the original one — undermining the very check this API exists
+    to perform.
+
     # Identifying the phone number from the access token
 
     This API requires the API consumer to identify a phone number as the subject of the API as follows:
@@ -178,7 +186,7 @@
           description: |
             Set to true (Boolean, not string) when there has been a change in the subscriber associated with the specific phone number after “specifiedDate”.
   responses:
     Generic200:
       description: OK
       headers:
         x-correlator: