Problem description
As discussed in Commonalities issue#171 & PR233 we need to shift the device object to optional.

Expected behavior
Apply the mechanism to rely on the access_token (not providing the device object in the API request) for 3-legged access scenarios. This would fix interoperability in all these scenarios, which is a huge improvement. We can define the device identifier as optional in the API specification and, if not provided, simply refer to access_tokehttps://github.com/camaraproject/Commonalities/pull/233n. The developer would simply not provide any further device information, which is simpler. The operator does not need to check that the device identifier actually matches the access_token provided and could simply rely on the access_token itself.

Alternative solution

Additional context