ISO/TS 23029:2020 金融サービスにおけるWebサービスベースのアプリケーションプログラミングインターフェイス（WAPI） | ページ 2

Foreword

ISO (the International Organization for Standardization) is a worldwide federation of national standards bodies (ISO member bodies). The work of preparing International Standards is normally carried out through ISO technical committees. Each member body interested in a subject for which a technical committee has been established has the right to be represented on that committee. International organizations, governmental and non-governmental, in liaison with ISO, also take part in the work. ISO collaborates closely with the International Electrotechnical Commission (IEC) on all matters of electrotechnical standardization.

The procedures used to develop this document and those intended for its further maintenance are described in the ISO/IEC Directives, Part 1. In particular, the different approval criteria needed for the different types of ISO documents should be noted. This document was drafted in accordance with the editorial rules of the ISO/IEC Directives, Part 2 (see www.iso.org/directives ).

Attention is drawn to the possibility that some of the elements of this document may be the subject of patent rights. ISO shall not be held responsible for identifying any or all such patent rights. Details of any patent rights identified during the development of the document will be in the Introduction and/or on the ISO list of patent declarations received (see www.iso.org/patents ).

Any trade name used in this document is information given for the convenience of users and does not constitute an endorsement.

For an explanation of the voluntary nature of standards, the meaning of ISO specific terms and expressions related to conformity assessment, as well as information about ISO's adherence to the World Trade Organization (WTO) principles in the Technical Barriers to Trade (TBT), see www.iso.org/iso/foreword.html .

This document was prepared by Technical Committee ISO/TC 68, Financial services, Subcommittee SC 9, Information exchange for financial services.

Introduction

0.1 Opening comments

The purpose of this document is to help implementers in the financial services industry define the framework, function and protocols for an application programming interface (API) ecosystem, enabling online synchronised interactions. It documents an international view of an API ecosystem in response to an urgent and significant world-wide demand for guidance and standardisation of APIs in financial services.

This has been driven by a number of emerging requirements – market-, corporate- and regulatory-driven – from different communities and jurisdictions for financial institutions to share data and enable functionality, such as between third parties acting on behalf of the customer, client or end user; between business to business processes; and within internal processes. It has been widely agreed that standardised APIs provide the most secure, developer-friendly, efficient, technically proven way of meeting many of these requirements. Moreover, it is understood that a standardised approach would unlock benefits conducive to promoting interoperability, enhancing security and supporting innovation. The sharing of data, and the subsequent use of APIs, is not limited to exchanges referenced in this document.

Despite these emerging requirements, there is currently no standardised approach at an international level. Moreover, there is no informative documentation covering the various considerations for developing APIs in financial services, especially given the maturity of some of its components (e.g. some are in draft). This document has been developed in response to meet these current and foreseen requirements that exist in the market. This document does not specify implementations of APIs, but instead takes an international view and references, as appropriate, specific implementation scenarios for illustrative purposes for guidance.

0.2 How to approach this document

This document should be approached as a best-practice framework for developing APIs in financial services. In this sense, some aspects of the document are more mature than others. The document is prescriptive where there is room to be. Where areas are less mature, commentary on best practice has been provided and the considerations set out.

Broadly speaking, this document adopts the following logic and order:

• Clause 3: terms and definitions used in the document;
• Clause 4: the initial considerations for the design of the API;
• Clause 5: overview and commentary on the different technology options;
• Clause 8: specific guidance on APIs under WAPI technical specification.

In Annex A, we set out an example of how to approach the document depending on a specific business area/desired API functionality.

1 Scope

This document defines the framework, function and protocols for an API ecosystem that will enable online synchronised interaction. Specifically, the document:

• defines a logical and technical layered approach for developing APIs, including transformational rules. Specific logical models (such as ISO 20022 models) are not included, but they will be referenced in the context of specific scenarios for guidance purposes;
• will primarily be thought about from a RESTful design point of view, but will consider alternative architectural styles (such as WebSocket and Webhook) where other blueprints or scenarios are offered;
• defines for the API ecosystem design principles of an API, rules of a Web-service-based API, the data payload and version control;
• sets out considerations relevant to security, identity and registration of an API ecosystem. Specific technical solutions will not be defined, but they will be referenced in the context of specific scenarios for guidance purposes;
• defines architectural usage beyond query/response asynchronous messaging towards publish/subscribe to support advanced and existing business models.

This document does not include:

• a specific technical specification of an API implementation in financial services;
• the development of JSON APIs based on the ISO 20022 specific message formats, such as PAIN, CAMT and PACS;
• a technical specification that is defined or determined by specific legal frameworks.

2 Normative references

There are no normative references in this document.

3 Terms and definitions

For the purposes of this document, the following terms and definitions apply.

ISO and IEC maintain terminological databases for use in standardization at the following addresses:

Bibliography