CAPIF (Common API Framework)

Also known as: Common API Framework

CAPIF is the 3GPP framework (TS 23.222 / TS 33.122) that standardises how 3GPP northbound APIs are published, discovered, authenticated and authorised. It defines the roles of API provider, API invoker and CAPIF core function, and mandates OAuth2 or TLS-based authentication of external API consumers. NEF and SEAL exposures typically sit behind CAPIF.

Categories: Core NetworkSignalingSecurity Controls

CAPIF in context

The mobile core is where subscriber sessions, mobility and policy live. In 4G it is the EPC (MME, HSS, S/PGW); in 5G it is the Service-Based Architecture with AMF, SMF, UPF, AUSF, UDM and the NRF. Core exposure is the difference between a single-subscriber leak and a fleet-wide breach.

Signaling protocols carry the control-plane instructions that set up calls, register subscribers, hand over sessions and route SMS. SS7, Diameter, GTP-C and SIP are the four dominant families, and interconnect exposure of any of them is treated by GSMA FS.11 / FS.19 / FS.20 as a top-tier telecom risk.

To place CAPIF in the wider telecom-security picture, review Hardening, 5G SBA, Core Network Security Assessment, Network Exposure Function (NEF), ACL and Authorization.

Related terms

Equipment

Network exposure (NEF, SCEF, network APIs)

Articles in the P1 mobile network security guide

Related topic hubs

  • 5G NEF Security Network Exposure Function security in the 5G core.
  • SEPP Security N32-c/N32-f, PRINS, JWE and OAuth 2.0 at the 5G roaming edge.
  • SS7 Security SS7/MAP/CAP/SCCP attacks and defenses across 2G/3G interconnect.
  • Diameter Security 4G/LTE Diameter threats across IPX/roaming and DEA defenses.

More from the TelcoSec Glossary

Browse the full TelcoSec Glossary, the Ultimate Guide to Mobile Network Security, or the P1 Arsenal of telecom-security tools.