Overview
ISO 20078-2:2021 - "Road vehicles - Extended vehicle (ExVe) web services - Part 2: Access" defines how an accessing party securely accesses resources on an offering party’s web‑services interface for connected vehicles. The standard mandates use of secure HTTP (HTTPS/TLS) and adopts the Representational State Transfer (REST) architectural pattern for resource paths. It specifies both synchronous request/reply and asynchronous push interaction patterns, including extensions to support asynchronous readouts (e.g., forcing data readouts from a connected vehicle).
Key technical topics
- REST-based web services over HTTPS with TLS (transport security) and HTTP/1.1+ compatibility.
- Interaction patterns:
- Request/reply (recommended): client requests resource via HTTP GET/POST, server responds.
- Push: offering party pushes resources to accessing party; includes subscription initiation and confirmation.
- Push with subsequent request/reply: push of a reference followed by a fetch.
- Resource model and URIs:
- Resources exposed as plural-noun collections and uniquely identified by URIs (e.g., {base_URI}/vehicles/{vehicleId}/...).
- Base URI definition and compatibility with ExVe application resource paths.
- Subscription profiles and reusable subscription information for push delivery.
- Container management API and OpenAPI specifications (Annex A, B, C).
- Operational controls and quality aspects addressed in the standard:
- Resource versioning
- Rate limits
- HTTP methods and response status codes
- Error messaging and interaction patterns (asynchronous handling)
- Media types and HTTP header fields
- Normative references include ISO 20078-1 (Content and definitions), ISO 8601 (date/time), and links to OpenAPI artifacts.
Key requirements (examples)
- REQ_04_01_01: Interface shall use HTTPS with TLS.
- REQ_04_01_02: HTTP shall be version 1.1 or higher.
- REQ_04_01_03: TLS shall be 1.2 or higher.
- REQ_04_01_05: Request/reply REST implementation shall be stateless.
- REQ_04_02_02: Exposed resources shall be uniquely identified by URIs.
(These are representative requirement identifiers from the standard.)
Practical applications and who uses it
ISO 20078-2 is targeted at organizations building and operating connected vehicle ecosystems:
- Vehicle manufacturers (OEMs) designing ExVe server endpoints.
- Telematics service providers and backend platform architects.
- Tier‑1 suppliers implementing ECU/vehicle data exposure.
- Fleet operators and telematics integrators consuming vehicle data securely.
- Security and API teams specifying access control, rate limiting, and asynchronous workflows for vehicle data.
Adopting ISO 20078-2 helps ensure interoperable, secure, and predictable access to vehicle resources for telemetry, diagnostics (DTC readouts), vehicle functions (lock/unlock), and other telematics services.
Related standards
- ISO 20078-1: ExVe content and definitions (normative for Part 2).
- ISO 20078-3: Authentication and authorization (related to access control).
- ISO 8601: Date and time representations used by the standard.
