Question: At what point(s) in the process may an API invoker need to execute the authorization procedure to access a service API, according to 3GPP Northbound API guidelines?
Option 1: Only when initially registering for API access
Option 2: Exclusively during periodic system maintenance windows
Option 3: Upon expiry of existing authorization information or when needing initial access (e.g., during onboarding)
Option 4: After every successful service API invocation
Explanation: The correct answer reflects the nuanced understanding that authorization isn't just a one-time event at the beginning but also an ongoing process. It must be re-obtained when existing authorization expires, ensuring continuous legitimate access to the service API, aligning with telecom network security best practices for both initial and sustained authorization for API usage.