Update API-design-guidelines.md

Author: rartych

documentation/API-design-guidelines.md

@@ -1669,7 +1669,7 @@ If this capability is present in CAMARA API, the following attributes **must** b
 
 | attribute name | type   | attribute description                                                                                                                                                                                                                                                                                       | cardinality |
 |----------------|--------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-------------| 
-| sink           | string | https callback address where the notification must be POST-ed                                                                                                                                                                                                                                               | mandatory   |
+| sink           | string | https callback address where the notification must be POST-ed, `format: uri` should be used to require a string that is compliant with [RFC 3986](https://datatracker.ietf.org/doc/html/rfc3986).                                                                                                                                                                                                                                        | mandatory   |
 | sinkCredential | object | Sink credential provides authentication or authorization information necessary to enable delivery of events to a target. In order to be updated in future this object is polymorphic. See detail below. It is RECOMMENDED for subscription consumer to provide credential to protect notification endpoint. | optional    |
 
 Several types of `sinkCredential` could be available in the future, but for now only access token credential is managed.