ISO 20078-2:2021

Overview

ISO 20078-2:2021 - "Road vehicles - Extended vehicle (ExVe) web services - Part 2: Access" defines how an accessing party securely accesses resources on an offering party’s web‑services interface for connected vehicles. The standard mandates use of secure HTTP (HTTPS/TLS) and adopts the Representational State Transfer (REST) architectural pattern for resource paths. It specifies both synchronous request/reply and asynchronous push interaction patterns, including extensions to support asynchronous readouts (e.g., forcing data readouts from a connected vehicle).

Key technical topics

• REST-based web services over HTTPS with TLS (transport security) and HTTP/1.1+ compatibility.
• Interaction patterns:
  • Request/reply (recommended): client requests resource via HTTP GET/POST, server responds.
  • Push: offering party pushes resources to accessing party; includes subscription initiation and confirmation.
  • Push with subsequent request/reply: push of a reference followed by a fetch.
• Resource model and URIs:
  • Resources exposed as plural-noun collections and uniquely identified by URIs (e.g., {base_URI}/vehicles/{vehicleId}/...).
  • Base URI definition and compatibility with ExVe application resource paths.
• Subscription profiles and reusable subscription information for push delivery.
• Container management API and OpenAPI specifications (Annex A, B, C).
• Operational controls and quality aspects addressed in the standard:
  • Resource versioning
  • Rate limits
  • HTTP methods and response status codes
  • Error messaging and interaction patterns (asynchronous handling)
  • Media types and HTTP header fields
• Normative references include ISO 20078-1 (Content and definitions), ISO 8601 (date/time), and links to OpenAPI artifacts.

Key requirements (examples)

• REQ_04_01_01: Interface shall use HTTPS with TLS.
• REQ_04_01_02: HTTP shall be version 1.1 or higher.
• REQ_04_01_03: TLS shall be 1.2 or higher.
• REQ_04_01_05: Request/reply REST implementation shall be stateless.
• REQ_04_02_02: Exposed resources shall be uniquely identified by URIs. (These are representative requirement identifiers from the standard.)

Practical applications and who uses it

ISO 20078-2 is targeted at organizations building and operating connected vehicle ecosystems:

• Vehicle manufacturers (OEMs) designing ExVe server endpoints.
• Telematics service providers and backend platform architects.
• Tier‑1 suppliers implementing ECU/vehicle data exposure.
• Fleet operators and telematics integrators consuming vehicle data securely.
• Security and API teams specifying access control, rate limiting, and asynchronous workflows for vehicle data.

Adopting ISO 20078-2 helps ensure interoperable, secure, and predictable access to vehicle resources for telemetry, diagnostics (DTC readouts), vehicle functions (lock/unlock), and other telematics services.

Related standards

• ISO 20078-1: ExVe content and definitions (normative for Part 2).
• ISO 20078-3: Authentication and authorization (related to access control).
• ISO 8601: Date and time representations used by the standard.