European vehicle-data exchange

Context

To support new EU regulation on cross-border enforcement of traffic offences, the organisation is modernising the technical architecture for European data exchange. Part of this work is an API gateway built on Microsoft YARP: a consistent entry point for services with shared capabilities for routing, security, transformation and observability.

Constraint

Multiple EU member states exchange data within one ecosystem. Every interface change must stay backward-compatible with existing national access points, and security requirements are non-negotiable: certificate-based authentication is the norm, not the exception.

Decisions

• Centralise routing and security policy in the gateway, rather than duplicating it across individual services.
• mTLS and certificate management as the default pattern for service-to-service communication.
• Earlier within the same ecosystem: a National Access Point for processing and validating IVI/XML and electronic Certificates of Conformity (eCoC), distributed across the wider EReg network.
• Secure messaging via eDelivery/AS4 (Domibus as an Access Point, P-Modes, certificates and encryption) for cross-border vehicle re-registration within the Once-Only Technical System.
• Azure Application Gateway with Web Application Firewall, container scanning and automated code analysis (SonarQube, Fortify) as a standing part of the CI/CD pipeline.

What it costs to run

Azure Container Apps and Container Registry, with Managed Identities and Key Vault for secret-less authentication. Observability via OpenTelemetry and centralised monitoring, so production issues are traceable across application, network and infrastructure layers.

What I'd change

On a next engagement I'd set up contract testing between member states earlier, rather than validating it only once a second party actually integrates — that would have saved a number of iterations in the first release.