System Scope and Context

Cloud-agnostic note. This context view describes CTN in terms of capabilities and interface types, not products. Concrete platform choices (Azure as the current reference implementation, with AWS and self-hosted variants explicitly kept open) live in the Solution Strategy and the Deployment View. Vendor names below appear only as examples (“e.g.”) to make a capability tangible.

Business Context

The Connected Trade Network (CTN) operates within the container transport ecosystem, enabling secure data sharing between multiple parties involved in moving containers from origin to destination. The system bridges the gap between data custodians (who hold operational information) and data consumers (who need access to that information).

System Purpose

CTN creates a trusted environment where:

• Cargo Owners and Forwarders orchestrate transport operations
• Transport Parties (carriers, terminals, truckers) execute physical movements
• Data Custodians control access to their operational data
• Regulatory Authorities maintain oversight of transport activities

Business Scope

Within CTN Scope (2026):

• Association membership management and verification
• Endpoint registration and discovery
• VAD token generation and validation
• Local authorisation at the data provider (no central PDP)
• Compliance verification and audit trails

Outside CTN Scope:

• Physical container movements
• Commercial negotiations and contracts
• Payment processing and invoicing
• Customs clearance procedures
• Container tracking hardware
• Route optimization algorithms

Technical Context

External Interfaces

System/Actor	Interface Type	Protocol	Purpose
Transport Management Systems	REST API	HTTPS/JSON	Submit transport orders, receive status updates
Port Community Systems	Event Stream	AMQP/MQTT	Container movement events
Identity Providers	OAuth/OIDC	HTTPS	User authentication via Keycloak (chosen IdP, per ADR-00002), with outward federation to Microsoft Entra ID / eHerkenning / local accounts (ADR-00008)
Certificate Authorities	ACME	HTTPS	TLS certificate management
Document-Intelligence Service	AI Service	HTTPS	Excel/PDF processing for bulk participant onboarding (e.g. Azure Document Intelligence, AWS Textract)
Monitoring Systems	Metrics API	HTTPS	System health and performance (e.g. Azure Monitor, Prometheus/Grafana)

Communication Patterns

Synchronous Communications:

• Token validation requests
• Participant verification queries
• Authorization decisions
• API data requests

Asynchronous Communications:

• Event notifications via an event broker (e.g. Azure Event Grid, AWS EventBridge, Apache Pulsar, Kafka)
• Bulk participant onboarding
• Compliance verification workflows
• Transport status updates

Data Flows

Inbound Data:

1. Participant Registration Data
   Source: Organisations joining the association
   Format: JSON via REST API
   Content: Legal entity details, compliance info

2. Endpoint Registration Data
   Source: Data-providing participants
   Format: OpenAPI (YAML/JSON) + metadata
   Content: Endpoint label, base URL, supported data products

3. Authorisation Requests
   Source: Data consumers
   Format: JWT token (VAD)
   Content: Identity / participation claims

4. Event Notifications
   Source: Various transport systems
   Format: CloudEvents
   Content: Status updates, milestones

Outbound Data:

1. Verification Tokens
   Destination: Authorised parties
   Format: JWT (JWS signed, RS256)
   Type: VAD (participation)

2. Event Notifications
   Destination: Subscribed parties
   Format: CloudEvents via webhooks
   Content: Transport updates, party changes

3. Authorization Decisions
   Destination: API Gateways
   Format: JSON response
   Content: Allow/Deny with context

4. Audit Logs
   Destination: Compliance systems
   Format: Structured JSON logs
   Content: Access records, modifications

Integration Architecture

API Specifications

All external APIs follow OpenAPI 3.0 specifications with:

• Semantic versioning (v1, v2)
• Standardized error responses
• Rate limiting headers
• Correlation ID tracking

Event Schema

Events use CloudEvents specification with:

• Standard envelope format
• Type-based routing
• Schema registry for payload validation
• Guaranteed delivery semantics

Security Boundaries

• Public Zone: Participant and admin portals, API documentation
• DMZ: API gateways, event-broker endpoints, webhook receivers
• Private Zone: Core registers, relational databases, cache layer
• Restricted Zone: Secret stores and HSM-backed key material (e.g. Azure Key Vault, AWS KMS, HashiCorp Vault)

---

This context view shows CTN’s position within the container transport ecosystem and its integration points.