The document also provides guidance on the fulfilment of governance, including risk and regulatory contexts, that supports the effective, efficient, and acceptable use of DLT systems.

The audience includes but is not limited to academics, architects, customers, users, tool developers, regulators, auditors and standards development organizations.

— defines a logical and technical layered approach for developing APIs, including transformational rules. Specific logical models (such as ISO 20022 models) are not included, but they will be referenced in the context of specific scenarios for guidance purposes;

— will primarily be thought about from a RESTful design point of view, but will consider alternative architectural styles (such as WebSocket and Webhook) where other blueprints or scenarios are offered;

— defines for the API ecosystem design principles of an API, rules of a Web-service-based API, the data payload and version control;

— sets out considerations relevant to security, identity and registration of an API ecosystem. Specific technical solutions will not be defined, but they will be referenced in the context of specific scenarios for guidance purposes;

— defines architectural usage beyond query/response asynchronous messaging towards publish/subscribe to support advanced and existing business models.

This document does not include:

— a specific technical specification of an API implementation in financial services;

— the development of JSON APIs based on the ISO 20022 specific message formats, such as PAIN, CAMT and PACS;

— a technical specification that is defined or determined by specific legal frameworks.

— systems that provide digital asset custodian services and/or exchange services to their customers (consumers and businesses) and management of security when an incident occurs;

— asset information (including the signature key of the digital asset) that a custodian of digital assets manages.

This document is addressed to digital asset custodians that manage signature keys associated with digital asset accounts. In such a case, certain specific recommendations apply.

The following is out of scope of this document:

— core security controls of blockchain and DLT systems;

— business risks of digital asset custodians;

— segregation of customer's assets;

— governance and management issues.

This document covers the following topics:

—    Managing identity for individuals, organizations, things (IoT & objects), functions and processes and other entities including within and across DLT systems.

—    Description of the actors and their interactions and common interfaces.

—    Architectures.

—    Existing relevant standards and frameworks.

The TDEA modes of operation may be used in both wholesale and retail financial applications. The use of ISO/TR 19038:2005 provides the basis for the interoperability of products and facilitates the development of application standards that use the TDEA modes of operation. This Technical Report is intended for use with other ISO standards using DEA.