Getting started with BoB
Overview
This guide helps organisations start working with the BoB standard and explains the practical steps required to become a BoB participant and implement BoB-compatible systems.
It assumes that you are already familiar with the overall structure and purpose of the standard as described in:
Introduction to the BoB Standard →
This guide focuses on the practical onboarding process, including:
registering as a BoB participant
obtaining a Participant Identifier (PID)
preparing the required security keys
implementing the relevant APIs
testing interoperability with other participants
deploying systems in production
Roles in the BoB Ecosystem
Participants
Participants are organisations registered in BoB Metadata. (Further information under Phase 1: Application and Registration)
Each participant receives a unique Participant Identifier (PID).
Participants can be:
Public transport operators
Third parties reselling tickets from operators
System vendors supplying BoB-compliant functions (sometimes using their own PID for testing purposes)
Samtrafiken
Samtrafiken:
administers the BoB standard
manages the BoB Metadata infrastructure
coordinates collaboration between BoB participants
supports the development of the standard together with Samtrafiken’s owners and the BoB community
More information about Samtrafiken’s responsibilities can be found in:
Samtrafiken’s Role in the BoB Ecosystem →
BoB Main Contact Person
Each participant organisation must appoint a BoB Main Contact Person.
This person:
represents the organisation in BoB-related matters
has the mandate to make decisions for the organisation regarding BoB issues
acts as the primary contact with Samtrafiken
The contact person cannot be a representative from a system supplier.
If the organisation participates in financing the administration of the standard, the contact person is responsible for coordinating replies to Requests for Comments (RFC) and may participate in the BoB Change Advisory Board (CAB).
Step by Step: How to Implement BoB
Overview of the Implementation Process
Implementing BoB typically involves four phases:
Application and registration
Technical preparation and key management
Implementation and testing
Production deployment
Each phase is described below.
Phase 1: Application and Registration
What you need to do
Appoint BoB Main Responsible Person
Choose a person in the organisation who will act as the main contact for BoB-related issues.
The person should:
be well anchored in the organisation
be familiar with your ticketing implementations
be able to coordinate BoB-related work internally
Register for BoB Training
Samtrafiken offers regular digital BoB basic training.
The training provides an accessible overview of the standard for all professional roles.
Registration via:
http://help.samtrafiken.se
Select Övriga supportärenden → BoB – Kursanmälan
Join BoB Tech (recommended)
BoB Tech is the technical community for organisations using the BoB standard.
BoB Tech includes:
a mailing list for technical discussions
regular BoB Tech Forum meetings organised by Samtrafiken
Membership can be requested via:
Jira Service Management
(Category: BoB – General support)
Apply for Participant ID (PID)
To participate in the BoB ecosystem your organisation must obtain a Participant Identifier (PID).
Read more about Participant Metadata here:
Security & Trust (Authentication and Participant Metadata) →
Apply for a PID via:
Jira Service Management
Provide:
organisation name
contact person
other relevant information
Samtrafiken will assign a unique PID that identifies your organisation in the BoB ecosystem.
Results of Phase 1
✅ Appointed BoB Main Responsible Person
✅ Basic understanding of the BoB standard
✅ Registered PID
Phase 2: Technical Preparation and Key Management
What you need to do
Generate Cryptographic Keys
BoB uses public-private key pairs for security.
Keys must be in JWK format (JSON Web Key according to RFC 7517).
Each key must have a unique Key ID (kid).
More information can be found in:
Security & Trust (Authentication and Participant Metadata) →
Key Exchange with Samtrafiken
Test Environment
For the test environment:
key exchange can be performed by the participant or system supplier
contact Samtrafiken to initiate key registration and receive a password
use the password to place the key in a password-protected ZIP file
send the public key via Jira Service Management
Production Environment
For the production environment:
the same procedure applies
the key must be sent by the BoB contact person
Receive Samtrafiken’s Keys
Samtrafiken provides its public keys (primary and fallback).
These are used to validate signatures from BoB Metadata.
Registration in BoB Metadata
Samtrafiken registers the participant’s public key in the BoB Metadata database.
Current status for all participants can be found here:
BoB participant metadata key registration status →
Results of Phase 2
✅ Generated key pairs
✅ Key exchange completed
✅ Registered in BoB Metadata
Phase 3: Implementation and Testing
What you need to do
Implement BoB APIs
Determine which APIs you need depending on your role.
Typical APIs include:
Authentication API
Product API
Ticket API
Validation API
Inspection API
Booking API (for on-demand traffic)
Token API (for ID-based travelling)
Traveller API
Full API documentation is available here:
Use BoB Test Environment (optional)
BoB-test is Samtrafiken’s shared test environment.
The environment runs on TESS (Ticketing Essentials System by Samtrafiken).
PID 1 can always be used for testing.
Guide:
Use BoB Metadata Docker Image (optional)
Samtrafiken provides a Docker image for local testing.
This enables isolated interoperability testing during development.
Compliance Test
Perform a compliance test using STEVE (SamTrafiken Essential Validation Environment).
More information:
Testing and Validation in BoB →
Test Interoperability
Test communication with other participants through BoB Metadata.
Verify that:
authentication works
encryption works
the specific flows used in your system function correctly
Results of Phase 3
✅ Implemented APIs
✅ Verified compliance
✅ Verified interoperability
Phase 4: Production Deployment
What you need to do
Production Keys
Conduct key exchange for the production environment (same process as for test).
Keys are registered in BoB Metadata Production.
Verify Production Environment
Verify that:
connection to BoB Metadata Production works
authentication functions correctly
Go-Live
Activate your systems in the production environment and begin issuing or validating BoB tickets.
Register in the List of Implementations
Register your system here:
List of Participant IDs and Known Implementations →
This helps other participants identify interoperability possibilities.
Results of Phase 4
✅ Registered in BoB Metadata Production
✅ System in operation
✅ Listed as active implementation
Ongoing Management and Support
Support Channels
BoB Support Portal
Primary support channel:
Jira Service Management
Handles:
general BoB questions
implementation support
PID registration and metadata support
test environment support
compliance test support
BoB Tech
Open technical discussions.
Participants can:
discuss implementation questions
share experience
propose improvements to the standard
BoB Tech Forum
Samtrafiken arranges four BoB Tech Forum meetings each year.
Meetings are normally digital, with one physical meeting each year.
Participants can suggest topics for discussion.
Personal Meetings
When needed, Samtrafiken can arrange personal meetings to help organisations better understand the BoB standard.
Requests can be made through the support portal.
Your Responsibility as a Participant
Participants are expected to:
keep their information in BoB Metadata up to date
participate in consultations about changes to the standard
inform Samtrafiken about relevant organisational or system changes
Participants are also encouraged to contribute to BoB Tech discussions.
Organisations financing the administration of the standard may participate in the Change Advisory Board (CAB).
Important Documents to Know
Important documentation includes:
These documents provide the detailed technical specifications required to implement BoB.
Next Steps
✅ Read through this document
⬜ Appoint BoB Main Responsible Person
⬜ Register for BoB basic training
⬜ Join BoB Tech
⬜ Apply for PID via Jira Service Management
⬜ Begin planning your technical implementation
Welcome to the BoB collaboration!