Members, not a hub
Each organisation is a registered member that runs its own security server at its edge. Data moves member to member, and nothing pools in the middle.
API EXCHANGE · X-ROAD PATTERN
Exchange data between organisations.
Keep it sovereign.
We design and build API exchanges and integration platforms on the model Estonia proved with X-Road, with API management on the open-source WSO2 stack.
THE MODEL
Six ideas that make
an exchange trustworthy.
Stable service identifiers
Every service is addressed as INSTANCE / CLASS / MEMBER / SUBSYSTEM / SERVICE, so consumers never depend on a host name or an IP address.
Mutual trust by certificate
Security servers authenticate each other with certificates issued by the exchange's trust services. Every message is signed and time-stamped.
Consent and evidence
Each service carries its consent rule. The exchange keeps routing and evidence records, never copies of member data.
One catalogue
Providers publish once and reach every subscriber. Consumers find services by name, sector, provider or endpoint, and subscribe once.
API management on open source
WSO2 for gateways, developer portals, keys, rate limits and analytics, behind the exchange or inside one organisation.
HOW A REQUEST TRAVELS
Edge to edge.
Nothing in the middle.
The exchange operator runs trust services and the catalogue. It never holds member data.
- 01Consumer system
- 02Consumer security server
- 03Signed, time-stamped message
- 04Provider security server
- 05Provider system
OUR EXPERIENCE
Designed at
national scale.
- Exchange architecture following the X-Road member model, with an operator, members, subsystems and security servers
- An interactive portal prototype: member registration, catalogue, flows, monitoring, cost and administration views
- Executive briefing and service scenarios for a national-scale exchange
- API management design on the WSO2 stack, with keys, rate limits, mutual TLS and audit
Client names and deployments are shared under NDA during discovery.
AI INSIDE THE EXCHANGE
AI that follows
the exchange’s rules.
AI fits the member model: it works at each member’s edge, with the same certificates, consent rules and audit as any other system.
Anomaly detection on traffic
Models learn each service’s normal traffic and flag unusual volumes, new callers, odd hours and failing services. They read routing and evidence records, never message content.
AI agents as governed consumers
An MCP gateway at a member’s security server lets approved AI agents call registered services, with certificates, consent, signing and audit applied as for any system.
Faster service onboarding
AI drafts service descriptions, OpenAPI documentation and catalogue tags for providers to review before publishing.
Plain-language catalogue search
Consumers find the service they need by asking in Arabic or English.
TYPICAL SERVICES
What organisations
exchange first.
- Identity and KYC checks
- Commercial registration lookups
- Tax number validation
- Email and mobile verification
- Open banking
- System-to-system integration inside one organisation
X-Road® is a registered trademark of the Nordic Institute for Interoperability Solutions (NIIS). Alin Li follows the open-source X-Road architecture and is not affiliated with or endorsed by NIIS. Learn more at x-road.global.
STAY CURIOUS
Plan your exchange.
Tell us who the members are, which services come first and where the data must stay.