Overview
ISO/TR 20078-4:2021 - Road vehicles - Extended vehicle (ExVe) web services - Part 4: Control - is a technical report that documents processes an offering party uses to provide access-controlled vehicle resources to third parties. It explains how registration, consent and access lifecycle operations (granting, denying, ignoring, revoking) are coordinated between the resource owner, the offering party and the accessing party. The report illustrates example flows combining ISO 20078‑1 (content), ISO 20078‑2 (web services) and ISO 20078‑3 (access control) and adds updates such as resource push behavior in the 2021 edition.
Key topics and technical requirements
- Roles and responsibilities: clear definitions for Resource Owner, Accessing Party and Offering Party and their interactions for consent and access control.
- Registration processes: onboarding of requesting parties and resource owners, issuance of credentials, approval/rejection workflows (online, offline or hybrid).
- Access control lifecycle: processes to grant, deny, ignore (pending) and revoke access to single resources or groups of resources.
- Containers: grouping of resources into containers (identified by container Id) to simplify consent decisions and consent management across multiple resources and VINs.
- Authentication & tokens: accessing parties use issued credentials to obtain access tokens; explicit resource-owner consent is required before access.
- Non-anonymized data handling: use of vehicle identifiers (VINs) when resources are not anonymized.
- Process examples and diagrams: sequence illustrations for registration, resource requests, container operations and revocation handling.
Note: ISO/TR 20078-4 provides process guidance and examples; actual implementations can vary depending on the offering party.
Practical applications
- Consent and access-management for vehicle telematics and API platforms.
- Enabling third‑party aftermarket services (diagnostics, insurance telematics, fleet analytics) to retrieve vehicle data under owner consent.
- Designing automotive web-service platforms that support containerized resource grouping and granular consent per VIN.
- Supporting privacy-compliant data marketplaces and OEM data-sharing portals.
- Operationalizing revocation and lifecycle rules for long-lived service subscriptions.
Who should use this standard
- OEM architects and telematics platform engineers
- Aftermarket service providers and fleet-management vendors
- API designers and IAM (identity & access management) teams in the automotive domain
- Privacy, compliance and security professionals working on vehicle data sharing
Related standards
Keywords: ISO/TR 20078-4:2021, Extended vehicle, ExVe web services, access control, vehicle data consent, containers, registration, grant revoke deny, VIN, automotive telematics, OEM data sharing.
