Developers and APIs: crosswalk to external standards
The external standards in the crosswalk domains of developers and APIs, from the register, with the relation of each to the Nexus Standards. Each row links to the issuing body, and each relation is evidenced by attestations identified by UNIs (Unique Nexus Identifier).
- Nexus Standards: NS-1, NS-6, NS-12.
- Open standards: OpenAPI Specification 3.1; AsyncAPI Specification 3.0; JSON Schema 2020-12; CodeMeta; RFC 8594 The Sunset HTTP Header Field; Semantic Versioning 2.0.0.
- Data and feeds: APIs.guru OpenAPI directory; deps.dev API; GitHub REST API (releases).
- Couples with: Conformance test suites; Registries and the resolver; Sandbox and simulated data.
The process.
The crosswalk as a table: 10 external standards by domain
| Domain | External standard | Issuing body | Relation |
|---|---|---|---|
| Software and supply chain integrity | Citation File Format (CITATION.cff) | Citation File Format project | adopt |
| Software and supply chain integrity | CodeMeta software metadata vocabulary | CodeMeta project | adopt |
| Software and supply chain integrity | CycloneDX Bill of Materials specification (ECMA-424) | OWASP CycloneDX; Ecma International TC54 | crosswalk |
| Software and supply chain integrity | JSON Schema 2020-12 | JSON Schema organisation | adopt |
| Software and supply chain integrity | OCI Image Format Specification | Open Container Initiative | adopt |
| Software and supply chain integrity | OpenAPI Specification | OpenAPI Initiative (Linux Foundation) | adopt |
| Software and supply chain integrity | OpenSSF Best Practices Badge | OpenSSF | cite |
| Software and supply chain integrity | OpenSSF Scorecard | OpenSSF | cite |
| Software and supply chain integrity | Reproducible Builds definition and practices | Reproducible Builds project | cite |
| Software and supply chain integrity | SPDX (System Package Data Exchange) specification; ISO/IEC… | SPDX project (Linux Foundation); ISO/IEC JTC 1 | adopt |
Nexus Standards in the graph: NS-6, NS-12. A relation is a register entry, never a compliance claim.
2 Nexus Standards · 1 domains · 10 external standards · 9 issuing bodies · 0 implementing repositories. Relations (adopt, profile, crosswalk, cite) are as recorded in the register; names and standards remain with their stewards.
Crosswalk graph22 nodes and 22 links from the registry of external standards, programme areas and implementations (the external standards register, the consumers register. Relations (adopt, profile, crosswalk, cite) are shown as recorded in the register.
- Nexus Standards
- 3
- NS-1, NS-6, NS-12
- Open standards
- 6
- named, never copied
- Data and feeds
- 3
- listed for reference
- Couplings
- 3
- with other areas
Software and supply chain integrity
10 register entries.
| Standard | Body | Version | Relation | Access | Verified |
|---|---|---|---|---|---|
| SPDX (System Package Data Exchange) specification; ISO/IEC 5962:2021 | SPDX project (Linux Foundation); ISO/IEC JTC 1 | 3.0.1 (December 2024); ISO/IEC 5962:2021 published 9 September 2021 covers an earlier 2.x version | adopt | open | verified |
| CycloneDX Bill of Materials specification (ECMA-424) | OWASP CycloneDX; Ecma International TC54 | 1.6 (9 April 2024; ECMA-424 ratified 26 June 2024); 1.7 and ECMA-424 2nd edition reported by one source | crosswalk | open | verified |
| OpenSSF Best Practices Badge | OpenSSF | passing, silver, gold tiers | cite | open | verified |
| OpenSSF Scorecard | OpenSSF | automated checks scored 0–10 | cite | open | unverified |
| CodeMeta software metadata vocabulary | CodeMeta project | 3.0 (2023); context lists 3.1 and the repository lists 4.0 | adopt | open | verified |
| Citation File Format (CITATION.cff) | Citation File Format project | 1.2.0 | adopt | open | unverified |
| OpenAPI Specification | OpenAPI Initiative (Linux Foundation) | 3.1.1 (24 October 2024); 3.1.2 and 3.2.0 dated 19 September 2025 in the repository changelog | adopt | open | verified |
| JSON Schema 2020-12 | JSON Schema organisation | 2020-12 (current per json-schema.org) | adopt | open | verified |
| OCI Image Format Specification | Open Container Initiative | 1.1 | adopt | open | unverified |
| Reproducible Builds definition and practices | Reproducible Builds project | current | cite | open | unverified |
Unverified entries rest on a secondary source for at least one field, as indicated in the register.
Relation types and their evidence
| Relation | Meaning | Evidence |
|---|---|---|
cite | The Nexus Standard refers to the external standard as context. | Identifier, version and URL in the register. |
profile | The Nexus Standard constrains or specialises an open external standard (for example STAC, DCAT, PROV-O, DataCite, CAP). | Conformance tests against the external standard’s own validator where one exists. |
crosswalk | Elements of the external standard map to Nexus elements (clauses, record fields). | A crosswalk table in the register entry; each row cites the external clause by number, never by text. |
adopt | The Nexus Standards use the external standard as it is for a function (for example ISO 3166-1, SPDX, ORCID, ROR). | Validation of values against the external scheme. |
extend | A Nexus Standard adds machine-readable, real-time or provenance elements that the external standard lacks. | The extension is a Nexus clause or field; the external standard is cited as the baseline. |
gap | No external standard covers the concern; a Nexus Standard specifies it. | The gap statement in the landscape study. |
Questions and answers.
Does a crosswalk establish that a developers and APIs artefact conforms to these standards?
Why are some relations shown as compatibility profile (restricted)?
Why are some entries marked unverified?
Around developers and APIs.
Shape the standards for developers and apis.
Governments, regulators, standards bodies, industry, academia and communities are invited to shape the catalogue ahead of its first official release, targeted for 2030: comment on a draft, propose a change, join a working group or host a field exercise.
Status and use. The Nexus Standards are proposed standards developed through an open process under NS-13 and published for voluntary use; they do not constitute certification, accreditation or regulatory approval, and adoption remains a decision of the Global Standards Council and, in each country, of its National Standards Council. A UNI (Unique Nexus Identifier) identifies an artefact; it does not certify it. Names of standards bodies and their standards belong to their stewards and are used only to identify the documents; no text of an external standard is reproduced here. Nexus Standards is not affiliated with, endorsed by or certified by any standards body named here.
Licences: CC BY 4.0 for standards text, registries, schemas and data; Apache-2.0 for reference code. External standards are cited by name, number and link under their own licences. Third-party data, libraries and fonts keep their own licences: see Third-party notices.