ANNEX IISupplementary provisions
ANNEX II Technical requirements referred to in Article 3(2) and Article 10(2) Data transmission An Application Programming Interface (API) gateway will expose a Representational State Transfer (REST) API. Each service provider collection system can call this API: (1) in real time – no limitation to the number of calls; (2) regularly, according to a schedule chosen by the service provider. API security Communication with the API Gateway will be secured via an API Key. Each service provider will have a specific API Key. This key will allow to secure the communication (encryption of the channel) and to know which service provider is sending data (authentication). API Keys will be available on a dedicated back-office web application. Each service provider will generate his key on the web application, download it and install on its premises. Requirements enabling the data transmission For the purpose of ensuring automatic transmission, the web analytics tool referred to in Article 3(2) and the alternative user feedback tool referred to in Article 10(2) shall: (a) allow transmission of data in JSON format via REST APIs; (b) support secure connections with Hyper-Text Transfer Protocol (HTTP) over Secure Sockets Layer (SSL); (c) support ISO 8601 for the representation of date and time. Date and time data shall be expressed in Coordinated Universal Time (UTC); (d) support a unique identifier for transmissions. A service provider pushes the data with a unique identifier provided through the API. If a service provider decides to change this data, it must push a correction with the same unique identifier. The frequency of transmission of statistics should not change the structure of the JSON file. For example, the JSON could contain array of objects (one per set of statistics for the reference period), an array of length n; The Commission shall provide a detailed technical description of the API for user feedback and statistics.