NEF & CAPIF — Network Capability Exposure and the Common API Framework¶

Learning objectives¶

After reading this chapter, you will be able to:

• Explain that Network Capability Exposure is "the activity of safely opening up 5GC-internal functions to external apps."
• Explain that the NEF (Network Exposure Function), as the gateway for exposure, is responsible for authorization, translation, and topology hiding.
• Give representative examples of what an external AF can do via the NEF (QoS requests, location retrieval, event subscription, parameter setting, etc.).
• Explain that CAPIF (Common API Framework) is "a common framework for API discovery, authentication/authorization, and onboarding."
• Explain the division of roles between the two: NEF = what to expose, and CAPIF = how to expose, discover, and authorize.

Prerequisites¶

• 5GC Overview (SBA) — Internal NFs interconnect over the SBI. The NEF bridges that SBI to the outside.
• AF (Application Function) — The primary consumer of capability exposure. An external AF makes requests to the 5GC via the NEF.
• Supplementary: NEF (details of the NF itself) / N33 (details of the external⇔NEF reference point)

Why — Why a capability-exposure mechanism is needed¶

Inside the 5GC there are many functions valuable to external apps (i.e., capabilities), such as UE location/reachability, QoS control, and subscriber parameters. If external third parties and applications (AFs) could use these, more advanced services would become possible (e.g., guaranteed bandwidth for a specific flow, location-linked services, IoT device management).

However, exposing the SBIs of internal NFs (PCF/UDM/AMF, etc.) directly to the outside creates serious problems.

• Security — Allowing direct access from the outside to internal NFs broadens the attack surface.
• Topology hiding — You do not want the internal configuration (which NF is where, internal identifiers) to be known to the outside.
• Authorization — There is a need to strictly manage "which external party may use which capability, and to what extent."

So a dedicated gateway is placed between the outside and the inside, where mediation, authorization, translation, and hiding take place. That gateway is the NEF.

Analogy: The NEF is the "reception counter of a building (the API gateway)." Rather than letting outsiders directly into the building's interior (internal NFs), the reception desk hears the request and connects them to the appropriate department. Reception also handles verifying the visitor's identity (authorization) and takes care not to reveal the internal seating chart (topology hiding).

What — The two concepts of NEF and CAPIF¶

Capability exposure involves two concepts of differing nature.

• NEF (what to expose) — The function itself that opens up the 5GC's internal capabilities to the outside. As a gateway, it provides individual capabilities (QoS requests, location, event notifications, etc.).
• CAPIF (how to expose, discover, and authorize) — The common conventions for API exposure. A framework that standardizes API discovery, authentication/authorization, and onboarding between API providers and consumers.

NEF — The gateway for Network Capability Exposure¶

The NEF receives requests from external AFs and bridges them to the SBIs of internal NFs. It is not a mere relay; it takes on the following roles.

• Authorization — Determines whether the requesting AF has the right to use that capability.
• Translation — Converts between the external-facing API format and the internal-NF-facing format in both directions.
• Hiding (topology hiding) — Does not reveal internal identifiers/configuration to the outside, mapping them to an external-facing representation.

The reference point between an external AF and the NEF is N33 (Nnef) (TS 23.501). The NEF's definition is specified in TS 23.501, and the exposure procedures in TS 23.502.

CAPIF — The Common API Framework¶

Building the mechanisms for discovery, authentication, and authorization separately for each individual API (the NEF's API, APIs of other domains, etc.) is inefficient. CAPIF (Common API Framework, TS 23.222) is a 3GPP-standard framework that unifies this.

• API discovery — Consumers can find out "what APIs are being provided."
• Authentication/authorization — Uniformly verifies a consumer's eligibility to use an API.
• Onboarding — Standardizes the procedure for registering and admitting a new API consumer.

CAPIF is not dedicated to a specific function; it is a general-purpose framework, defined as a common foundation for 3GPP northbound APIs. Its positioning is that the NEF can behave as CAPIF's API-providing function (AEF: API Exposing Function).

How — The path of capability exposure (Architecture)¶

An external AF/third party makes requests to the NEF through the reference point N33, and the NEF bridges them to internal NFs (PCF/UDM/AMF, etc.). CAPIF sits above this, involved as a common layer for API discovery and authorization.

graph LR
    AF[External AF / third party
API consumer] -->|N33 Nnef| NEF[NEF
exposure gateway / AEF]
    NEF -->|SBI| PCF[PCF
QoS/policy]
    NEF -->|SBI| UDM[UDM
subscriber parameters]
    NEF -->|SBI| AMF[AMF
location/reachability events]
    CAPIF[CAPIF
API discovery/auth] -.common conventions.-> NEF
    CAPIF -.discovery/authorization.-> AF

The key point of the diagram is that an external AF never touches internal NFs directly and always goes through the NEF. CAPIF (dotted lines) does not hold a specific capability; it is involved cross-cuttingly as the layer that provides the conventions for "how to discover and how to authorize."

Representative exposure functions of the NEF¶

These are representative examples of the capabilities the NEF exposes to the outside (representative only, not exhaustive; specific Nnef service names and detailed values to be confirmed).

Comparison of the roles of NEF and CAPIF¶

3GPP Specification¶

FAQ¶

Summary¶

• Network Capability Exposure is the activity of safely opening up the 5GC's internal capabilities to external AFs/third parties.
• The NEF is the gateway for exposure. It performs authorization, translation, and topology hiding, and bridges to internal NFs (PCF/UDM/AMF, etc.). The external reference point is N33 (Nnef).
• By not exposing the SBIs of internal NFs directly to the outside and having the NEF mediate, the attack surface and the exposure of internal configuration are curbed.
• CAPIF is a general-purpose common framework that standardizes API discovery, authentication/authorization, and onboarding (TS 23.222).
• The division of roles is clear: NEF = what to expose, CAPIF = how to expose, discover, and authorize. The NEF can become an AEF on top of CAPIF.

Comprehension check¶

Next Step¶

• For details of the NF that serves as the exposure gateway, go to NEF.
• Go to Policy (policy control / PCF), a representative target the NEF bridges to.
• Check AF, the primary consumer of capability exposure, and N33 for details of the reference point.
• For other 5GC procedures such as charging, see Charging.