Authentication, tenancy, and safe API usage
Supported API documentation will identify the exact authentication method, scopes, tenant selection, and credential lifecycle. Until then, no internal token or application credential is an integration credential.
Required controls
Section titled “Required controls”- Authenticate every request using the published mechanism.
- Authorize the action and tenant independently of supplied record IDs.
- Scope all reads and writes to the authorized
dealer_id. - Never expose service-role keys, encrypted GST tokens, cron/webhook secrets, staff sessions, or OTPs.
- Store approved credentials in a secret manager and rotate them when required.
- Use TLS, validate inputs, redact logs, and retain only necessary data.
- Respect rate limits and idempotency requirements.
Errors and support
Section titled “Errors and support”Future public endpoints will use documented status codes and a stable error shape. Support requests should include the request ID and timestamp, never credentials or complete sensitive payloads.
Was this page helpful?Yes·Needs improvement