NEF (Network Exposure Function)

What is NEF?

The Network Exposure Function (NEF) is a 3GPP-defined function within the 5G Core that securely exposes selected network capabilities, data and events to authorised Application Functions and external applications. It also enables approved external applications to provide information that can influence how services are delivered by the mobile network.  

Rather than allowing an enterprise application to communicate directly with sensitive 5G Core functions, the NEF acts as a controlled exposure layer. It validates requests, applies operator policies, translates external information into formats understood by internal network functions and prevents sensitive internal identifiers or network details from being exposed outside the operator domain. 

A full NEF-based network exposure framework typically includes: 

• Authentication and authorisation of applications, developers and API requests  

• Policy controls governing which network capabilities each application may access  

• Translation between external identifiers and internal 5G Core information  

• Event subscriptions and notifications for device or network-status changes  

• Provisioning of application information, service parameters and expected device behaviour  

• Exposure of capabilities relating to monitoring, QoS, traffic influence, analytics and charging

• API security, throttling, auditing, reporting and commercial controls  
  
  

3GPP groups NEF exposure capabilities into areas including monitoring, provisioning, policy and charging, analytics reporting and member-device selection. Examples of exposed information can include device reachability, mobility events, roaming status, connectivity changes and QoS monitoring results.  

Proper NEF implementation makes the telecom network programmable without giving external applications unrestricted access to the mobile core. This allows operators to support new enterprise services while maintaining security, subscriber privacy, operational control and regulatory compliance.

What is NEF CAMARA? 

“NEF CAMARA” commonly refers to the relationship between the 5G Core Network Exposure Function and CAMARA Network APIs. It is not a separate network function. 

CAMARA is a Linux Foundation open-source project that develops standardised, developer-friendly APIs for accessing telecom network capabilities consistently across different operators and countries. CAMARA works with the GSMA to align these API definitions with the GSMA Open Gateway initiative.  

In a typical deployment: 

Application → CAMARA or Open Gateway API → API gateway or aggregator → NEF and other operator systems → Mobile network 

The CAMARA API provides the simplified interface used by developers, while the NEF may provide secure access to the underlying 5G Core capability. GSMA architecture guidance identifies the NEF, or the 4G Service Capability Exposure Function, as a possible southbound exposure component for Open Gateway APIs. However, not every CAMARA API is implemented exclusively through the NEF; implementation depends on the API and the operator’s network architecture.  

Why is NEF important for Mobile Operators & Enterprises? 

Mobile networks contain valuable capabilities that traditional internet APIs cannot provide, including trusted device status, network-derived location, subscriber verification, connectivity information and programmable quality of service. 

NEF allows operators to expose these capabilities securely and commercially while retaining control over who can access them and under what conditions. For enterprises and developers, it removes much of the complexity associated with integrating directly with telecom network infrastructure.

Key benefits / features of NEF

• Secure, policy-controlled access to 5G network capabilities  

• Standardised integration between applications and 5G Core functions  

• Protection of internal subscriber identifiers and network topology  

• Real-time network events and device-status notifications 

• Programmable QoS and traffic-management capabilities  

• Faster development of fraud-prevention, identity, IoT and edge applications  

• New API monetisation opportunities for mobile operators  

• More consistent developer access through CAMARA and GSMA Open Gateway APIs  
  
  

Examples of NEF and CAMARA Network APIs

Quality on Demand for gaming, video and real-time applications 

An application can request a defined quality-of-service profile for a specific data flow. The operator’s exposure platform may use the NEF to translate the request and coordinate the required policy or session treatment within the 5G Core. 

CAMARA Quality on Demand APIs allow applications to create, monitor, extend and terminate QoS sessions without requiring the developer to understand the underlying mobile-network signalling. Typical use cases include cloud gaming, video conferencing, live streaming, extended reality and industrial control.  

Device reachability and connectivity checks 

Enterprises can check whether a device is currently reachable through mobile data, SMS or another supported access method before attempting to deliver a service or notification. 

The NEF can support subscriptions to network events such as reachability, loss of connectivity and mobility-status changes. CAMARA Device Reachability Status provides a simplified API that applications can use to retrieve this information.  

Network-based device location 

An authorised application can request network-derived location information for a device, subject to operator policy, user consent and applicable privacy requirements. 

This can support logistics, emergency services, asset tracking, fraud prevention and location-sensitive service delivery. CAMARA Location APIs provide developer-facing interfaces while the operator exposure layer coordinates with the relevant location and core-network systems.  

Silent mobile-number verification 

A banking, marketplace or digital application can verify that a mobile number is associated with the device and connection being used, without requiring the user to manually enter an SMS OTP. 

CAMARA Number Verification provides a standard API for this process, helping enterprises improve onboarding and authentication while reducing exposure to OTP interception and social-engineering attacks. The underlying implementation can involve several operator systems and is not necessarily provided by the NEF alone.  

IoT monitoring and service provisioning 

An enterprise IoT platform can subscribe to device-connectivity events, provide expected device behaviour or request network treatment for connected sensors and machines. 

The NEF provides a controlled path for exchanging approved information between the IoT application and the 5G Core. This supports use cases such as smart metering, fleet tracking, industrial automation and massive IoT device management. 

Common questions about NEF

1. How does NEF work?

   An authorised Application Function sends an API request to the NEF. The NEF authenticates and authorises the request, applies operator policies, performs any required identifier or data translation and communicates with the relevant 5G Core functions. It then returns the approved response or sends event notifications to the application.

2. Is NEF the same as an API gateway?
   No. An API gateway normally manages developer-facing functions such as credentials, API products, rate limits, routing and analytics. The NEF is a 3GPP-defined 5G Core function responsible for securely exposing network capabilities. Operators commonly deploy both as different layers of the Network API architecture.
3. Is NEF the same as CAMARA?  
   

   No. NEF is a network function inside the operator’s 5G architecture. CAMARA defines standard APIs that developers can use across operators. A CAMARA API may obtain an underlying network capability through the NEF, but the two perform different roles. 

4. Does every CAMARA API connect to the NEF?
   

   No. Some APIs may use the NEF, while others may connect to subscriber-data platforms, identity systems, location systems, fraud platforms or other operator infrastructure. The exact implementation depends on the API and the operator.

5. What is the 4G equivalent of NEF?
   

   In 4G networks, network capabilities are commonly exposed through the Service Capability Exposure Function, or SCEF. The NEF performs the corresponding exposure role within the 5G Core architecture.
   

Related Terms

CAMARA; GSMA Open Gateway; Network API; Service Capability Exposure Function (SCEF); Application Function (AF); 5G Core; API Gateway; Quality on Demand (QoD); Policy Control Function (PCF); Session Management Function (SMF); Access and Mobility Management Function (AMF); Network Data Analytics Function (NWDAF); Device Reachability; Number Verification; Device Location; Event Exposure; Traffic Influence; Consent Management. 

Sources 

• ENISA — Interconnect Security (SS7/Diameter)  
• GSMA — FS.11 SS7 interconnect security monitoring and firewall guidelines  
• GSMA — Interworking security knowledge base (monitoring + firewall rule-setting)  
• ITU — Technical report on SS7 vulnerabilities and mitigation measures (DFS context)  
• ENISA — Security in 5G specifications (SEPP as security gateway for roaming/interconnect)  

Last Updated: March 2026