GBZ 104-2017Technical specification of web-service-based application programming interface(WAPI) in financial services (English PDF)

Foreword

This document is a standard or guiding technical document.

This document complies with the provisions of GB/T 1.1-2020 "Standardization Work Guidelines Part 1: Structure and Drafting Rules of Standardization Documents".

Drafting.

This document is equivalent to ISO/T S23029.2020 "Application Programming Interfaces for Internet Services in Financial Services". (Document type) the model has been changed from an ISO technical specification to a national standardization guiding technical document of my country.

The following minimal editorial changes have been made to this document.

---To align with existing standards, the standard's name has been changed to "Technical Specification for Application Programming Interfaces Based on Internet Services in Financial Services".

Fan;

---Note added for groups using Uniform Resource Identifiers (URIs) (see 8.2.6);

---Added a note to the resource filter (see 8.2.8.4);

---Added a note to the security and authentication overview (see 10.1);

---Added a note regarding standard website certificates issued by globally trusted certificate authorities (see 10.2.1.2);

---Added a note for signing the JSON payload (see 10.6.3).

Please note that some content in this document may involve patents. The issuing organization of this document assumes no responsibility for identifying patents.

This document is under the jurisdiction of the National Financial Standardization Technical Committee (SAC/TC180).

Introduction

With changes in business and regulatory rules in the financial sector, major global financial institutions are increasingly focusing on web application programming interfaces (Web APIs) for the financial industry.

There is an urgent need to standardize the development and design methodologies of APIs, particularly among financial institutions, intermediaries, and regulatory bodies that generate and consume data.

As interactions become more frequent and complex, the need for data transmission security is growing. This necessitates defining application programming interfaces (APIs) for development.

The logical and technical layering approach to APIs includes API design principles, web service-based API rules, data payload, and versioning.

Control can effectively guide financial institutions in defining standardized Web APIs, thereby further providing secure and user-friendly interfaces that meet the aforementioned needs.

Good, efficient technical guidance.

In my country, there are relatively few design specifications for Web APIs used for interaction between financial institution infrastructures. This document will help guide domestic financial institutions...

The development of WebAPI technology in the financial market helps financial institutions standardize application programming interfaces and achieve secure and efficient remote online data exchange.

This interactive approach is also of great significance for improving the standard system of my country's financial market.

Internet-based financial services Application Programming Interface Technical Specification

1 Scope

This document outlines the framework for the application programming interface (API) ecosystem commonly found in financial services based on Internet (Web) services.

Framework, functions, and protocols to enable online synchronous interaction. Specific content includes.

--- Defines the logical and technical layering methods for developing APIs, including transformation rules, but excluding specific logical models [e.g.] [ISO.20022 (all parts) model], but in specific scenarios, a logical model may be referenced to guide the definition of the API;

This design primarily focuses on RESTful presentation layer state transitions, but also includes architectural styles for other scenarios, such as web applications.

WebSocket and Webhook;

---Defines the API design principles, web service-based API rules, data payload, and version control;

--- This section lists considerations related to security, identity, and registration in API design.

This document applies to the design and application of Web service-based APIs in the financial services industry, providing guidance for internal operations within financial institutions and for collaboration between financial institutions and application providers.

Users share data and services to provide a reference.

This document does not apply to the following.

---Specific technical specifications for API implementation in financial services;

---A script object based on the ISO.20022 (all parts) specific message format, a lightweight data exchange format.

(JSON)API;

---Technical specifications defined or determined by a specific legal framework.

Note. Appendix A provides examples of how to process documents based on specific business areas or required API functionality.

2 Normative references

This document has no normative references.

3 Terms and Definitions

The following terms and definitions apply to this document.

A set of well-defined methods, functions, protocols, transactions, or commands that application software calls using programming language development tools.

Use the service.

Note. WAPI is an application programming interface provided by the Web system that enables external interconnection and the construction of HTTP services.

idempotency

Idempotency

An operation is characterized by the fact that the effect of executing the same operation multiple times is the same as the effect of executing it once.

Note. Because it is difficult to restrict redundant access in a web environment, idempotent operations are often used in the design of web-based systems.