Use the API and signed integrations
Integrate inventory, edge events and operational workflows with scoped credentials and idempotent requests.
Expected result
An integration sends authorized data without exposing customer secrets or duplicating operations.
Integration rules
Use a unique credential for each service and producer. Sign the exact request body with a timestamp and nonce. Reusing a nonce is rejected.
Provider mutations require an idempotency key and produce a persistent operation before the external API is called.
Verification
- Signature and timestamp are accepted
- Duplicate nonce is rejected
- Operation has an audit record