Why Germany's Mobilithek Is Hard to Integrate — and How NAPSPAN Handles It

Mobilithek is Germany's National Access Point — the federal hub for traffic, mobility, and AFIR EV-charging data, operated by T-Systems on behalf of the BMDV. Since the operational retirement of MDM (the Mobility Data Marketplace) in H1 2025, Mobilithek is the canonical entry point for any production-grade German mobility integration. From 2026-04-14, DATEX II is the mandatory exchange format on it.

Most public APIs use API keys. Mobilithek doesn't. It uses TLS client-certificate authentication (mTLS): your client presents an X.509 certificate during the TLS handshake, and the broker decides whether you're allowed to pull or get pushed to.

This trips up almost everyone integrating for the first time. There is no Authorization: Bearer ... header. There is no API key. And because the access decision happens during the TLS handshake, a misconfigured client doesn't get a clean 401 Unauthorized — it gets a generic connection error that looks like a network fault, sending you down a long debugging session looking in the wrong place.

Why the first integration hurts

The pain isn't that mTLS is exotic — it's well-understood technology. It's that the moving parts sit outside the request you're trying to make, in places a normal HTTP integration never has to think about.

Certificate issuance is out-of-band. Before you can make a single call, you register an organisation as a data consumer, get approved (this takes days, not minutes), and exchange a certificate signing request for an issued client certificate through an admin portal. None of that is in your code; all of it has to be right before your code can work.

A failed handshake doesn't look like an auth failure. With API keys, a bad credential gives you a 401 or 403 and a message that points you at the problem. With mTLS, the broker can drop a connection that presents the wrong certificate, an expired certificate, or a certificate issued for a different environment — and all three surface as the same vague "connection reset" or "EOF." The error tells you nothing about which of the dozen possible causes you hit.

The failure modes stack. Even once the handshake succeeds, a request can still be rejected because the certificate isn't authorised for the specific dataset you asked for, or because that dataset was retired and migrated elsewhere. Each is a distinct problem with a distinct fix, and none of them is the kind of thing you can guess from the outside.

Certificates expire on a schedule nobody reminds you of. Renewal is manual and out-of-band, just like issuance. A feed that has run cleanly for months can go dark overnight, and the symptom — a dropped handshake — looks identical to the day-one misconfiguration you already debugged once.

Then there's the payload itself: what comes back is DATEX II XML, the European standard for traffic and travel information. Authenticating is only the entry fee; you still have to parse the standard, map it into your own model, and diff successive fetches to track each incident's lifecycle — new severity, a revised estimated end time, archival when it clears.

Why you shouldn't have to deal with any of it

Mobilithek is just one of 30+ National Access Points that NAPSPAN aggregates — and it's one of the more awkward ones to onboard. Every NAP has its own version of this: a different auth scheme, a different envelope, a different set of quirks that only reveal themselves after you've spent a week on them. Multiply that by 30 countries and the "just call the API" plan stops being a plan.

NAPSPAN absorbs that work so you never see it. We hold the Mobilithek consumer account, manage the client certificates and their renewals, run the polling against the right datasets, parse the DATEX II, and track each incident's lifecycle — and then we serve the result the way every other source is served: through a single normal API key, over plain HTTPS, in one consistent schema across all 30+ countries.

From your side, German motorway data is just another query — the same shape as data from every other country we cover. No certificates to request, no handshakes to debug, no renewals to diarise, no DATEX II parser to maintain.

• Live map — explore the data visually
• API docs — full endpoint reference
• Developer portal — sign up and get an API key

Mobilithek's mTLS design is sound — the cost isn't the cryptography, it's the out-of-band setup, the opaque failures, and the ongoing maintenance that every one of 30+ National Access Points adds in its own way. That's exactly the work NAPSPAN exists to take off your plate.