CAPIF Architecture Explained: A Deep Dive into the 5G Common API Framework
Understanding CAPIF Architecture: The Backbone of 5G API Exposure
In today's world of 5G and open networks, APIs (Application Programming Interfaces) have become essential — they’re the glue connecting telecom operators, third-party developers, and service providers, driving innovation.
As telecom networks grow more complex with multiple domains, functions, and services, it can be tough to manage, expose, and secure APIs across the board.
To tackle this issue, 3GPP rolled out the Common API Framework (CAPIF) — a cohesive, standardized way to handle API exposure and management within 5G service-based architectures (SBA).
The graphic titled “CAPIF Architecture” illustrates how CAPIF Core Functions, API Providers, and API Invokers work together across PLMN (Public Land Mobile Network) and Third-Party Trust Domains.
Let’s break it down step-by-step.
What is CAPIF (Common API Framework)?
Defined by 3GPP TS 23.222, CAPIF is a framework for smoothly exposing and utilizing network APIs securely across various domains, including both 3GPP and non-3GPP networks.
Its main goals include:
Standardizing API exposure
Making API discovery and onboarding easier
Ensuring consistent authentication and authorization
Facilitating secure and auditable API interactions
Basically, CAPIF creates a cohesive layer where telecom and third-party APIs can exist under a common trust model—which helps prevent fragmentation and ensures everything works well together.
Why CAPIF Matters in 5G
5G networks rely on network slicing, edge computing, IoT, and service-based architectures, all of which heavily depend on APIs.
Without standardization, each network or vendor might expose APIs in their own way, leading to:
Complicated integrations
Security issues
Interoperability challenges
CAPIF addresses these issues by providing:
A single point of access for all APIs
Consistent security frameworks
Standardized exposure interfaces
This makes it a lot easier for application developers to tap into telecom capabilities like:
Network analytics
Edge discovery
Quality of Service (QoS) control
Device location and session management
Overview of CAPIF Architecture (as per the image)
The diagram displays three main components across two trust domains — PLMN Trust Domain and Third-Party Trust Domain:
CAPIF Core Function
API Provider Domain(s)
API Invokers (1, 2, and 3)
Each of these plays a key role in managing the API lifecycle, exposure, and interaction.
CAPIF Core Function
Nestled in the PLMN Trust Domain, the CAPIF Core Function serves as the central hub for all exposed APIs.
It offers CAPIF APIs (as shown in the image) that take care of:
API discovery
Authentication & authorization
Security auditing
Access control
API publishing and registration
Key CAPIF Interfaces:
Interface Purpose
CAPIF-1e: API invoker onboarding & authentication
CAPIF-3: API provider onboarding
CAPIF-4: API publishing & service registration
CAPIF-5: Access control & authorization
CAPIF-2e: Service API exposure to invokers
These interfaces ensure that every API request follows a standardized path — from registration to invocation — keeping security and consistency intact.
API Provider Domain
Each API Provider Domain (reflected on the right side of the image) contains network service APIs — like those related to location, session management, policy control, or edge computing.
An API Provider Domain is made up of three main functions:
API Exposing Function
API Publishing Function
API Management Function
a. API Exposing Function
This is where service APIs are made available to CAPIF. It allows for:
Secure exposure of APIs to external invokers
Enforcement of access policies
Monitoring and analytics
b. API Publishing Function
This handles the registration and cataloging of APIs with the CAPIF Core Function. It ensures that new APIs can be discovered and accessed by authorized invokers.
c. API Management Function
Responsible for:
Managing the API lifecycle
Enforcing policies
Monitoring and usage tracking
Together, these functions let telecom operators and service providers share their APIs securely while keeping visibility and control.
API Invokers
The API Invokers (marked as Invoker 1, 2, and 3 in the image) are the clients or applications that consume the APIs.
They can be part of either:
The PLMN trust domain (like internal network applications), or
A third-party trust domain (like developers or enterprise apps).
Each API Invoker interacts through the specified CAPIF interfaces such as:
CAPIF-1e: For authentication with CAPIF Core
CAPIF-2e: For accessing service APIs exposed by providers
CAPIF-7e: For API management reporting and analytics
This allows for secure, authenticated access while ensuring compliance with operator policies.
Trust Domains in CAPIF
The image clearly distinguishes between two trust domains:
PLMN Trust Domain
Managed by the Mobile Network Operator (MNO). This includes:
CAPIF Core Function
API Provider Domains
Internal API Invokers
The PLMN Trust Domain maintains native network security and compliance.
Third-Party Trust Domain
Managed by external developers, enterprises, or service integrators. This includes:
External API Invokers
Possibly external API providers
The CAPIF framework securely bridges these trust domains, fostering third-party innovation without jeopardizing network integrity.
How CAPIF Ensures Secure API Operations
Security is at the heart of CAPIF’s design. It guarantees:
Mutual authentication between API consumers and providers
Token-based authorization (like OAuth2 / OpenID Connect)
Auditing and logging of every API interaction
Trust-based onboarding for both providers and invokers
Every API call must be validated via the CAPIF Core, ensuring end-to-end traceability and protection against unauthorized access.
Example Workflow: How CAPIF Works
Let’s look at a typical API call process step-by-step:
Onboarding: The API Invoker (like a third-party app) registers with the CAPIF Core using CAPIF-1e.
API Discovery: CAPIF Core supplies info about available APIs through CAPIF-3/4 interfaces.
API Access Request: The Invoker requests access to a specific API via CAPIF-5.
Authorization & Token Issuance: CAPIF Core validates credentials and issues a token.
API Invocation: The Invoker uses CAPIF-2e to call the API in the Provider Domain.
Monitoring & Auditing: CAPIF logs the entire transaction for traceability and billing.
This standardized workflow ensures secure, scalable, and interoperable API communication across various networks.
Benefits of CAPIF Architecture
Benefit Description
Unified API Exposure: One framework for all APIs, minimizing fragmentation.
Enhanced S ecurity: Built-in authentication, authorization, and audit features.
Faster Developer Onboarding: Streamlined discovery and registration of APIs.
Interoperability: Works smoothly across multiple network and vendor environments.
Scalability: Capable of supporting thousands of APIs and invokers.
By providing a consistent API management layer, CAPIF is vital for enabling open network innovation in 5G and beyond.
Real-World Applications of CAPIF
Network as a Service (NaaS): Exposing network capabilities to developers.
Edge Computing APIs: Facilitating low-latency applications.
IoT Platform Integration: Connecting millions of devices in a secure manner.
Enterprise Network APIs: Offering QoS or security as a service.
Overall, CAPIF backs the Open Gateway Initiative by GSMA, allowing telecom operators to provide standardized APIs to developers around the globe.
Conclusion
The CAPIF Architecture is a crucial component in the 5G service-based ecosystem, delivering a secure, standardized, and scalable method for exposing and consuming APIs.
By clarifying the roles of CAPIF Core, API Providers, and API Invokers, it guarantees that telecom networks can safely open their capabilities to third-party developers — fostering innovation, simplifying processes, and enabling real network programmability.
As the telecom sector shifts towards Open APIs and Network-as-a-Service models, CAPIF will continue to be the foundational framework ensuring security, interoperability, and seamless collaboration between operators and developers in the 5G landscape.