diff --git a/src/main/java/org/opencord/aaa/api/AaaEvent.java b/src/main/java/org/opencord/aaa/api/AaaEvent.java
new file mode 100644
index 0000000..d1d8ed6
--- /dev/null
+++ b/src/main/java/org/opencord/aaa/api/AaaEvent.java
@@ -0,0 +1,183 @@
+/*
+ * Copyright 2017-present Open Networking Foundation
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.opencord.aaa.api;
+
+import org.onlab.packet.MacAddress;
+import org.onlab.packet.VlanId;
+import org.onosproject.event.AbstractEvent;
+import org.onosproject.net.ConnectPoint;
+
+import java.util.Objects;
+
+/**
+ * Describes an authentication event. Note that the subject of the event
+ * is a {@link ConnectPoint}, but the event also carries fields for
+ * a {@link VlanId VLAN} and {@link org.onlab.packet.MacAddress MAC} to
+ * be specified if desired.
+ */
+public class AaaEvent extends AbstractEvent<AaaEvent.Type, ConnectPoint> {
+
+    /**
+     * Designates the type of authentication event.
+     */
+    public enum Type {
+        /**
+         * A supplicant has started an authorization request handshake.
+         */
+        AUTH_START,
+
+        /**
+         * A supplicant has submitted an authorization request.
+         */
+        AUTH_REQUEST_ACCESS,
+
+        /**
+         * The authorization request has been accepted.
+         */
+        ACCESS_AUTHORIZED,
+
+        /**
+         * The authorization request has been denied.
+         */
+        ACCESS_DENIED,
+
+        /**
+         * The supplicant has terminated the authenticated session.
+         */
+        AUTH_LOGOFF
+    }
+
+    // a VLAN associated with the event
+    private final VlanId vlanId;
+
+    // a MAC address associated with the event
+    private final MacAddress macAddress;
+
+    /**
+     * Creates an event of the given type, for the specified connect point and
+     * the current time.
+     * The VLAN and MAC fields are left as null.
+     *
+     * @param type    authentication event type
+     * @param subject event connect point subject
+     */
+    public AaaEvent(Type type, ConnectPoint subject) {
+        super(type, subject);
+        vlanId = null;
+        macAddress = null;
+    }
+
+    /**
+     * Creates an event of the given type, for the specified connect point,
+     * and time.
+     * The VLAN and MAC fields are left as null.
+     *
+     * @param type    authentication event type
+     * @param subject event connect point subject
+     * @param time    occurrence time
+     */
+    public AaaEvent(Type type, ConnectPoint subject, long time) {
+        super(type, subject, time);
+        vlanId = null;
+        macAddress = null;
+    }
+
+    /**
+     * Creates an event of the given type, for the specified connect point and
+     * the current time.
+     * Additionally, associated VLAN and MAC may be defined (null permitted).
+     *
+     * @param type       authentication event type
+     * @param subject    event connect point subject
+     * @param vlanId     a VLAN associated with this event (or null)
+     * @param macAddress a MAC address associated with ths event (or null)
+     */
+    public AaaEvent(Type type, ConnectPoint subject, VlanId vlanId,
+                    MacAddress macAddress) {
+        super(type, subject);
+        this.vlanId = vlanId;
+        this.macAddress = macAddress;
+    }
+
+    /**
+     * Creates an event of the given type, for the specified connect point,
+     * and time.
+     * Additionally, associated VLAN and MAC may be defined (null permitted).
+     *
+     * @param type       authentication event type
+     * @param subject    event connect point subject
+     * @param time       occurrence time
+     * @param vlanId     a VLAN associated with this event
+     * @param macAddress a MAC address associated with ths event (or null)
+     */
+    public AaaEvent(Type type, ConnectPoint subject, long time, VlanId vlanId,
+                    MacAddress macAddress) {
+        super(type, subject, time);
+        this.vlanId = vlanId;
+        this.macAddress = macAddress;
+    }
+
+    /**
+     * Returns the VLAN ID associated with this event (may be null).
+     *
+     * @return the associated VLAN ID
+     */
+    public VlanId vlanId() {
+        return vlanId;
+    }
+
+    /**
+     * Returns the MAC address associated with this event (may be null).
+     *
+     * @return the associated MAC address
+     */
+    public MacAddress macAddress() {
+        return macAddress;
+    }
+
+
+    @Override
+    public boolean equals(Object o) {
+        if (this == o) {
+            return true;
+        }
+        if (o instanceof AaaEvent) {
+            final AaaEvent other = (AaaEvent) o;
+            return Objects.equals(this.type(), other.type()) &&
+                    Objects.equals(this.subject(), other.subject()) &&
+                    Objects.equals(this.time(), other.time()) &&
+                    Objects.equals(this.vlanId(), other.vlanId()) &&
+                    Objects.equals(this.macAddress(), other.macAddress());
+        }
+        return false;
+    }
+
+    @Override
+    public int hashCode() {
+        return Objects.hash(type(), subject(), time(), vlanId(), macAddress());
+    }
+
+    @Override
+    public String toString() {
+        StringBuilder sb = new StringBuilder(super.toString());
+        int len = sb.length();
+        sb.replace(len - 1, len, ", ");
+        sb.append("vlanId=").append(vlanId)
+                .append(", mac=").append(macAddress)
+                .append("}");
+        return sb.toString();
+    }
+}
diff --git a/src/main/java/org/opencord/aaa/api/AaaListener.java b/src/main/java/org/opencord/aaa/api/AaaListener.java
new file mode 100644
index 0000000..8abe565
--- /dev/null
+++ b/src/main/java/org/opencord/aaa/api/AaaListener.java
@@ -0,0 +1,24 @@
+/*
+ * Copyright 2017-present Open Networking Foundation
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.opencord.aaa.api;
+
+import org.onosproject.event.EventListener;
+
+/**
+ * Entity capable of receiving authentication related events.
+ */
+public interface AaaListener extends EventListener<AaaEvent> {
+}
diff --git a/src/main/java/org/opencord/aaa/api/AaaService.java b/src/main/java/org/opencord/aaa/api/AaaService.java
new file mode 100644
index 0000000..e1e4da1
--- /dev/null
+++ b/src/main/java/org/opencord/aaa/api/AaaService.java
@@ -0,0 +1,63 @@
+/*
+ * Copyright 2017-present Open Networking Foundation
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.opencord.aaa.api;
+
+
+import org.opencord.aaa.PacketCustomizer;
+
+/**
+ * Service API for interacting with the AAA application.
+ */
+public interface AaaService {
+
+    /**
+     * Adds the specified listener for authentication events.
+     *
+     * @param listener the listener
+     */
+    void addListener(AaaListener listener);
+
+    /**
+     * Removes the specified listener for authentication events.
+     *
+     * @param listener the listener
+     */
+    void removeListener(AaaListener listener);
+
+
+    // TODO: need to provide method to report current status
+    //    for each state machine: {ConnectPoint, StateMachine.currentState}
+
+
+    /**
+     * Registers a packet customizer with AAA, to be used to customize
+     * packets issued to and from the RADIUS server.
+     *
+     * @param customizer the customizer to register
+     */
+    void registerPacketCustomizer(PacketCustomizer customizer);
+
+    /**
+     * Unregisters the given packet customizer from AAA.
+     * <p>
+     * Note: AAA will revert to a default customizer, that does no
+     * customization of the packets.
+     *
+     * @param customizer the customizer to unregister
+     */
+    void unregisterPacketCustomizer(PacketCustomizer customizer);
+
+}
diff --git a/src/main/java/org/opencord/aaa/api/package-info.java b/src/main/java/org/opencord/aaa/api/package-info.java
new file mode 100644
index 0000000..050fd3c
--- /dev/null
+++ b/src/main/java/org/opencord/aaa/api/package-info.java
@@ -0,0 +1,20 @@
+/*
+ * Copyright 2015-present Open Networking Foundation
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * AAA application public API.
+ */
+package org.opencord.aaa.api;
diff --git a/src/test/java/org/opencord/aaa/PrintableTest.java b/src/test/java/org/opencord/aaa/PrintableTest.java
new file mode 100644
index 0000000..8905473
--- /dev/null
+++ b/src/test/java/org/opencord/aaa/PrintableTest.java
@@ -0,0 +1,41 @@
+/*
+ * Copyright 2017-present Open Networking Foundation
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.opencord.aaa;
+
+/**
+ * Base class for unit tests, providing simple print facilities.
+ */
+public abstract class PrintableTest {
+
+    /**
+     * Prints the given string to stdout.
+     *
+     * @param s the string
+     */
+    protected void print(String s) {
+        System.out.println(s);
+    }
+
+    /**
+     * Prints the string representation of the given object to stdout.
+     *
+     * @param o the object
+     */
+    protected void print(Object o) {
+        print(o.toString());
+    }
+
+}
diff --git a/src/test/java/org/opencord/aaa/api/AaaEventTest.java b/src/test/java/org/opencord/aaa/api/AaaEventTest.java
new file mode 100644
index 0000000..56b0aab
--- /dev/null
+++ b/src/test/java/org/opencord/aaa/api/AaaEventTest.java
@@ -0,0 +1,108 @@
+/*
+ * Copyright 2017-present Open Networking Foundation
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.opencord.aaa.api;
+
+import org.junit.Test;
+import org.onlab.packet.MacAddress;
+import org.onlab.packet.VlanId;
+import org.onosproject.net.ConnectPoint;
+import org.opencord.aaa.PrintableTest;
+import org.opencord.aaa.api.AaaEvent.Type;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertNotEquals;
+import static org.junit.Assert.assertNotSame;
+import static org.onosproject.net.ConnectPoint.deviceConnectPoint;
+
+/**
+ * Unit tests for {@link AaaEvent}.
+ */
+public class AaaEventTest extends PrintableTest {
+
+    private static final long TIME1 = 12345L;
+    private static final long TIME2 = 54321L;
+    private static final ConnectPoint CP1 = deviceConnectPoint("of:01/1");
+    private static final ConnectPoint CP2 = deviceConnectPoint("of:02/2");
+    private static final VlanId VLAN_32 = VlanId.vlanId((short) 32);
+    private static final VlanId VLAN_64 = VlanId.vlanId((short) 64);
+    private static final MacAddress MAC_A = MacAddress.valueOf(0xa);
+    private static final MacAddress MAC_B = MacAddress.valueOf(0xb);
+
+    private static final AaaEvent AEV_1 =
+            new AaaEvent(Type.AUTH_START, CP1, TIME1);
+    private static final AaaEvent AEV_2 =
+            new AaaEvent(Type.AUTH_START, CP1, TIME1, VLAN_32, null);
+    private static final AaaEvent AEV_3 =
+            new AaaEvent(Type.AUTH_LOGOFF, CP1, TIME1);
+    private static final AaaEvent AEV_4 =
+            new AaaEvent(Type.AUTH_LOGOFF, CP1, TIME2);
+    private static final AaaEvent AEV_5 =
+            new AaaEvent(Type.AUTH_LOGOFF, CP2, TIME2);
+    private static final AaaEvent AEV_6 =
+            new AaaEvent(Type.AUTH_LOGOFF, CP2, VLAN_64, null);
+    private static final AaaEvent AEV_7 =
+            new AaaEvent(Type.AUTH_REQUEST_ACCESS, CP1, TIME1, VLAN_64, null);
+    private static final AaaEvent AEV_7_AGAIN =
+            new AaaEvent(Type.AUTH_REQUEST_ACCESS, CP1, TIME1, VLAN_64, null);
+    private static final AaaEvent AEV_8 =
+            new AaaEvent(Type.AUTH_REQUEST_ACCESS, CP1, TIME1, VLAN_64, MAC_A);
+    private static final AaaEvent AEV_9 =
+            new AaaEvent(Type.AUTH_REQUEST_ACCESS, CP1, TIME1, VLAN_64, MAC_B);
+    private static final AaaEvent AEV_10 =
+            new AaaEvent(Type.AUTH_REQUEST_ACCESS, CP1, TIME1, null, MAC_B);
+
+
+    private AaaEvent event;
+
+    @Test
+    public void basic() {
+        event = new AaaEvent(Type.ACCESS_DENIED, CP1, TIME1);
+        print(event);
+        assertEquals(Type.ACCESS_DENIED, event.type());
+        assertEquals(TIME1, event.time());
+        assertEquals(CP1, event.subject());
+        assertEquals(null, event.vlanId());
+    }
+
+    @Test
+    public void vlan32() {
+        event = new AaaEvent(Type.ACCESS_AUTHORIZED, CP1, VLAN_32, MAC_A);
+        print(event);
+        assertEquals(Type.ACCESS_AUTHORIZED, event.type());
+        assertEquals(CP1, event.subject());
+        assertEquals(VLAN_32, event.vlanId());
+        assertEquals(MAC_A, event.macAddress());
+    }
+
+    @Test
+    public void checkEquivalence() {
+        assertNotEquals(AEV_1, AEV_2);
+        assertNotEquals(AEV_1, AEV_3);
+        assertNotEquals(AEV_3, AEV_4);
+        assertNotEquals(AEV_4, AEV_5);
+        assertNotEquals(AEV_5, AEV_6);
+        assertNotEquals(AEV_6, AEV_7);
+        assertNotSame(AEV_7, AEV_7_AGAIN);
+        assertEquals(AEV_7, AEV_7_AGAIN);
+
+        assertNotEquals(AEV_7, AEV_8);
+        assertNotEquals(AEV_7, AEV_9);
+        assertNotEquals(AEV_7, AEV_10);
+        assertNotEquals(AEV_8, AEV_9);
+        assertNotEquals(AEV_8, AEV_10);
+        assertNotEquals(AEV_9, AEV_10);
+    }
+}