api-catalog: a well-known URI to help discovery of APIs

Status of This Memo

This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79.¶

Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet-Drafts is at https://datatracker.ietf.org/drafts/current/.¶

Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress."¶

This Internet-Draft will expire on 12 August 2024.¶

Copyright Notice

Copyright (c) 2024 IETF Trust and the persons identified as the document authors. All rights reserved.¶

This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Revised BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Revised BSD License.¶

Table of Contents

1. Introduction

An organisation or individual may publish Application Programming Interfaces (APIs) to encourage requests for interaction from external parties. Such APIs must be discovered before they may be used - i.e., the external party needs to know what APIs a given publisher exposes, their purpose, any policies for usage, and the endpoint to interact with each APIs. To facilitate automated discovery of this information, and automated usage of the APIs, this document proposes a well-known URI, 'api-catalog', as a location where a Publisher's API endpoints are described in an API catalog document.¶

2. Using the 'api-catalog' well-known URI

The api-catalog well-known URI is intended for HTTP(S) servers that publish APIs. As the key aim is to facilitate their discovery and usage, a Publisher supporting this URI:¶

• SHOULD host the /.well-known/api-catalog URI at a predictable location. For example as companies typically own a .com TLD, a predictable location for the company 'example' would be https://www.example.com/.well-known/api-catalog¶

• SHALL resolve an HTTP(S) GET request to /.well-known/api-catalog and return an API catalog document, as described in Section 5¶

• SHOULD resolve an HTTP(S) HEAD request to /.well-known/api-catalog with a response including a Link header with the relation(s) defined in Section 6¶

3. Accounting for APIs distributed across multiple domains

A Publisher ('example') may have their APIs hosted across multiple domains that they manage: e.g., at example.com, developer.example.com, apis.example.com, apis.example.net etc. They may also use a third party API hosting provider which hosts APIs on a distinct domain.¶

To account for this scenario, it is recommended that:¶

• the Publisher publish the api-catalog well-known URI at a predictable location, as described above.¶

• the Publisher also publish the api-catalog well-known URI at each of their API domains e.g. apis.example.com/.well-known/api-catalog, developer.example.com/.well-known/api-catalog etc.¶

• only one of these locations needs to host the canonical API Catalog document. The other locations SHOULD redirect any requests they receive for /.well-known/api-catalog to that primary location, using HTTP Status Code 308 Permanent Redirect [RFC9110].¶

As illustration, if the Publisher's primary API portal is apis.example.com, then apis.example.com/.well-known/api-catalog should be the location to host the API Catalog document. If the Publisher is also the domain authority for example.net, which also hosts a selection of their APIs, then a request to www.example.net/.well-known/api-catalog SHOULD return a redirect as follows.¶

Clienr request:¶

GET /.well-known/api-catalog HTTP/1.1
User-Agent: curl/7.16.3 libcurl/7.16.3 OpenSSL/0.9.7l zlib/1.2.3
Host: www.example.net

Server response:¶

HTTP/1.1 308 Permanent Redirect
Content-Type: text/html; charset=UTF-8
Location: http\://apis.example.com/.well-known/api-catalog
Content-Length: 356

<!DOCTYPE HTML>
  <html>
    <head>
      <title>Permanent Redirect</title>
      <meta http-equiv="refresh" content="0; url=https://apis.example.com/.well-known/api-catalog">
    </head>
    <body>
      <p>The document has been moved to <a href=https://apis.example.com/.well-known/api-catalog>https://apis.example.com/.well-known/api-catalog</a>.</p>
    </body>
  </html>

4. Internal use of api-catalog for private APIs

A Publisher may wish to use the api-catalog well-known URI on their internal network, to signpost authorised users (e.g. company employees) towards internal/private APIs not intended for third-party use. This scenario may incur additional security considerations, as noted in Section 9¶

5. The API Catalog

The API Catalog is a document listing hyperlinks to a Publisher's APIs.¶

There is no mandated format for the API Catalog document: the Publisher is free to choose any format that supports the automated discovery, and machine (and human) usage of their APIs. However, it is RECOMMENDED to use a linkset [RFC9264] of API endpoints (see Appendix A for an example).¶

The API Catalog document MUST include hyperlinks to API endpoints, and is RECOMMENDED to include useful metadata, such as usage policies, API version information, links to the OpenAPI Specification [OAS] definitions for each API, etc. . If the Publisher does not include these metadata directly in the API Catalog document, they SHOULD make that metadata available at the API endpoint URIs they have listed (see Appendix A.2 for an example).¶

Some suitable API Catalog document formats include:¶

• (RECOMMENDED) A linkset [RFC9264] of API endpoints and information to facilitate API usage¶

• An APIs.json document [APIsjson]¶

• API bookmarks that represent an API entry-point URI, which may be followed to discover purpose and usage¶

• A RESTDesc semantic description for hypermedia APIs [RESTdesc]¶

• A Hypertext Application Language document [HAL]¶

• An extension to the Schema.org WebAPI type [WebAPIext]¶

Appendix A includes example API Catalog documents based on the linkset format.¶

6. Link relations

• "item" [RFC9264]. When used in an API Catalog document, the 'item' link relation identifies a target resource that represents a API that is a member of the API Catalog.¶

• "api-catalog": the 'api-catalog' link relation identifies a target resource that represents a list of APIs of which the context resource is a member.¶

7. Conformance to RFC8615

The requirements in section 3 of [RFC8615] for defining Well-Known Uniform Resource Identifiers are met as follows:¶

8. IANA Considerations

9. Security Considerations

For all scenarios: the Publisher SHOULD perform a security and privacy review of the API Catalog prior to deployment, to ensure it does not leak personal, business or other metadata, nor expose any vulnerability related to the APIs listed.¶

For the internal/private APIs scenario: the Publisher SHOULD take steps to ensure that appropriate access controls are in place to ensure only authorised users access the internal api-catalog well-known URI.¶

Appendix A. Example API Catalog document

This section is informative, and provides and example of an API Catalog document using the RECOMMENDED linkset format.¶

GET .well-know/api-catalog HTTP/1.1
Host: example.com
Accept: application/linkset+json

HTTP/1.1 200 OK
Date: Mon, 01 Jun 2023 00:00:01 GMT
Server: Apache-Coyote/1.1
Content-Type: application/linkset+json

{
  "linkset": [
  {
    "anchor": "https://developer.example.com/apis/foo_api",
    "service-desc": [
      {
        "href": "https://developer.example.com/apis/foo_api/spec",
        "type": "application/yaml"
      }
    ],
    "status": [
      {
        "href": "https://developer.example.com/apis/foo_api/status",
        "type": "application/json"
      }
    ],
    "service-doc": [
      {
        "href": "https://developer.example.com/apis/foo_api/doc",
        "type": "text/html"
      }
    ],
    "service-meta": [
      {
        "href": "https://developer.example.com/apis/foo_api/policies",
        "type": "text/xml"
      }
    ]
  },
  {
    "anchor": "https://developer.example.com/apis/bar_api",
    "service-desc": [
      {
        "href": "https://developer.example.com/apis/bar_api/spec",
        "type": "application/yaml"
      }
    ],
    "status": [
      {
        "href": "https://developer.example.com/apis/bar_api/status",
       "type": "application/json"
      }
    ],
    "service-doc": [
      {
        "href": "https://developer.example.com/apis/bar_api/doc",
        "type": "text/plain"
      }
    ]
  },
  {
    "anchor": "https://apis.example.net/apis/cantona_api",
    "service-desc": [
      {
        "href": "https://apis.example.net/apis/cantona_api/spec",
        "type": "text/n3"
      }
    ],
    "service-doc": [
      {
        "href": "https://apis.example.net/apis/cantona_api/doc",
        "type": "text/html"
      }
    ]
  }
  ]
}

GET .well-know/api-catalog HTTP/1.1
Host: example.com
Accept: application/linkset+json

HTTP/1.1 200 OK
Date: Mon, 01 Jun 2023 00:00:01 GMT
Server: Apache-Coyote/1.1
Content-Type: application/linkset+json

[
  { "anchor": "https://example.com/.well-known/api-catalog",
    "item": [
      {"href": "https://developer.example.com/apis/foo_api"},
      {"href": "https://developer.example.com/apis/bar_api"}
      {"href": "https://developer.example.com/apis/cantona_api"}
    ]
  }
]

Appendix B. Acknowledgements

Thanks to Phil Archer, Ben Bucksch, Sanjay Dalal, Max Maton, Darrel Miller, Mark Nottingham, Roberto Polli, Rich Salz, Herbert Van De Sompel and Erik Wilde for their suggestions and feedback.¶

Author's Address