]> api-catalog: a well-known URI to help discovery of APIs Vodafone
kevin.smith@vodafone.com https://www.vodafone.com
IETF internet-draft This document defines the "api-catalog" well-known URI. It is intended to facilitate automated discovery and usage of the APIs published by a given organisation or individual. The latest revision of this draft can be found at . Status information for this document may be found at . Discussion of this document takes place on the Building Blocks for HTTP APIs Working Group mailing list (), which is archived at . Subscribe at . Source for this draft and an issue tracker can be found at .
Introduction An organisation or individual may publish Application Programming Interfaces (APIs) to encourage requests for interaction from external parties. Such APIs must be discovered before they may be used - i.e., the external party needs to know what APIs a given publisher exposes, their purpose, any policies for usage, and the endpoint to interact with each APIs. To facilitate automated discovery of this information, and automated usage of the APIs, this document proposes a well-known URI, 'api-catalog', as a location where a Publisher's API endpoints are described in an API catalog document.
Terminology 'Publisher' - an organisation, company or individual that publishes one or more APIs for usage by external third parties.
Goals and non-goals The primary goal is to facilitate the automated discovery of a Publisher's public API endpoints, along with metadata that describes the purpose and usage of each API, by specifying a well-known URI that returns an API catalog document. The API catalog document is primarily machine-readable to enable automated discovery and usage of APIs, and it may also include links to human-readable documentation. Non-goals: this document does not mandate paths for API endpoints. i.e., it does not mandate that my_example_api's endpoint should be example.com/.well-known/api-catalog/my_example_api , nor even to be hosted at example.com (although it is not forbidden to do so). This document does not mandate a specific format for the API catalog document, although it does suggest some existing formats and provide a recommendation.
Requirements Language The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 when, and only when, they appear in all capitals, as shown here.
Using the 'api-catalog' well-known URI The api-catalog well-known URI is intended for HTTP(S) servers that publish APIs. As the key aim is to facilitate their discovery and usage, a Publisher supporting this URI: SHOULD host the /.well-known/api-catalog URI at a predictable location. For example as companies typically own a .com TLD, a predictable location for the company 'example' would be https://www.example.com/.well-known/api-catalog SHALL resolve an HTTP(S) GET request to /.well-known/api-catalog and return an API catalog document, as described in SHOULD resolve an HTTP(S) HEAD request to /.well-known/api-catalog with a response including a Link header with the relation(s) defined in
Accounting for APIs distributed across multiple domains A Publisher ('example') may have their APIs hosted across multiple domains that they manage: e.g., at example.com, developer.example.com, apis.example.com, apis.example.net etc. They may also use a third party API hosting provider which hosts APIs on a distinct domain. To account for this scenario, it is recommended that: the Publisher publish the api-catalog well-known URI at a predictable location, as described above. the Publisher also publish the api-catalog well-known URI at each of their API domains e.g. apis.example.com/.well-known/api-catalog, developer.example.com/.well-known/api-catalog etc. only one of these locations needs to host the canonical API Catalog document. The other locations SHOULD redirect any requests they receive for /.well-known/api-catalog to that primary location, using HTTP Status Code 308 Permanent Redirect . As illustration, if the Publisher's primary API portal is apis.example.com, then apis.example.com/.well-known/api-catalog should be the location to host the API Catalog document. If the Publisher is also the domain authority for example.net, which also hosts a selection of their APIs, then a request to www.example.net/.well-known/api-catalog SHOULD return a redirect as follows. Clienr request:
Server response:
Permanent Redirect

The document has been moved to https://apis.example.com/.well-known/api-catalog.

]]>
Internal use of api-catalog for private APIs A Publisher may wish to use the api-catalog well-known URI on their internal network, to signpost authorised users (e.g. company employees) towards internal/private APIs not intended for third-party use. This scenario may incur additional security considerations, as noted in
The API Catalog The API Catalog is a document listing hyperlinks to a Publisher's APIs. There is no mandated format for the API Catalog document: the Publisher is free to choose any format that supports the automated discovery, and machine (and human) usage of their APIs. However, it is RECOMMENDED to use a linkset of API endpoints (see for an example). The API Catalog document MUST include hyperlinks to API endpoints, and is RECOMMENDED to include useful metadata, such as usage policies, API version information, links to the OpenAPI Specification definitions for each API, etc. . If the Publisher does not include these metadata directly in the API Catalog document, they SHOULD make that metadata available at the API endpoint URIs they have listed (see for an example). Some suitable API Catalog document formats include: (RECOMMENDED) A linkset of API endpoints and information to facilitate API usage An APIs.json document API bookmarks that represent an API entry-point URI, which may be followed to discover purpose and usage A RESTDesc semantic description for hypermedia APIs A Hypertext Application Language document An extension to the Schema.org WebAPI type Appendix A includes example API Catalog documents based on the linkset format.
Link relations "item" . When used in an API Catalog document, the 'item' link relation identifies a target resource that represents a API that is a member of the API Catalog. "api-catalog": the 'api-catalog' link relation identifies a target resource that represents a list of APIs of which the context resource is a member.
Conformance to RFC8615 The requirements in section 3 of for defining Well-Known Uniform Resource Identifiers are met as follows:
Path prefix The api-catalog URI SHALL be appended to the /.well-known/ path-prefix for "well-known locations".
Supported URI schemes The api-catalog well-known URI may be used with the HTTP and HTTPS URI schemes.
Registration of the api-catalog well-known URI See considerations below.
IANA Considerations
The api-catalog well-known URI This specification registers the "api-catalog" well-known URI in the Well-Known URI Registry as defined by . URI suffix: api-catalog Specification document(s): draft-ietf-httpapi-api-catalog-01 Related information: The "api-catalog" documents obtained from the same host using the HTTP and HTTPS protocols (using default ports) MUST be identical.
The api-catalog link relation This specification registers the "api-catalog" link relation by following the procedures per section 4.2.2 of Relation Name: api-catalog Description: Identifies a catalog of APIs published by the context Publisher. Reference: draft-ietf-httpapi-api-catalog-01
Security Considerations For all scenarios: the Publisher SHOULD perform a security and privacy review of the API Catalog prior to deployment, to ensure it does not leak personal, business or other metadata, nor expose any vulnerability related to the APIs listed. For the internal/private APIs scenario: the Publisher SHOULD take steps to ensure that appropriate access controls are in place to ensure only authorised users access the internal api-catalog well-known URI.
&RFC8615; &RFC2119; &RFC8174; &RFC9110; &RFC9264; &RFC6415; &RFC8288; OpenAPI Specification 3.1.0 APIs.json JSON Hypertext Application Language RESTdesc WebAPI type extension &RFC8631;
Example API Catalog document This section is informative, and provides and example of an API Catalog document using the RECOMMENDED linkset format.
Using Linkset with RFC8615 relations This example uses the linkset format , and the following link relations defined in : "service-desc", used to link to a description of the API that is primarily intended for machine consumption. "service-doc", used to link to API documentation that is primarily intended for human consumption. "service-meta", used to link to additional metadata about the API, and is primarily intended for machine consumption. "status", used to link to the API status (e.g. API "health" indication etc.) for machine and/or human consumption. Client request:
Server response:
Using Linkset with bookmarks This example also uses the linkset format , listing the API endpoints in an array of bookmarks. Each link shares the same context (the API Catalog) and "item" link relation (to indicate they are an item in the catalog).The intent is that by following a bookmark link, a machine-client can discover the purpose and usage of each API, hence the document targeted by the bookmark link should support this. Client request:
Server response:
Acknowledgements Thanks to Phil Archer, Ben Bucksch, Sanjay Dalal, Max Maton, Darrel Miller, Mark Nottingham, Roberto Polli, Rich Salz, Herbert Van De Sompel and Erik Wilde for their suggestions and feedback.