Skip to main content

Security

The API uses HTTPS, API-key authentication, resource scopes and company or agency access controls. Apply the following controls when building and operating your integration.

Transport and credentials​

Use https://api.requidex.com/api/open/v1 and verify TLS certificates. Non-HTTPS Open API requests are rejected.

Treat an API key as a secret. Send it only in the Authorization header, store it in your server's secret configuration, and exclude it from source control, logs, analytics and support messages. Use a separate key per integration and revoke keys that are no longer needed.

Run production integrations from a trusted backend. Do not embed a shared API key in a public website, browser bundle or mobile application. The API Explorer is intended for manual testing with your own key; it keeps the key in tab memory rather than browser storage.

Limit access​

Grant only the companies or agencies and scopes the integration requires. Read-only integrations should not have write scopes. A scope authorises an operation but does not expand the caller's tenant access or override endpoint-specific restrictions.

For integrations with a fixed outbound address, an IP allowlist restricts which public source IPs can use the key. Account for proxies and outbound gateways when configuring it. A configured expiry date limits the credential's lifetime.

See Authorization and Scopes for the access model and Authentication for key lifecycle rules.

Handle returned data carefully​

API responses can contain workforce, financial and document data. Limit storage and downstream access to what your integration needs. Apply appropriate access controls to exports and logs, and avoid retaining full responses solely for debugging.

Temporary upload and download URLs grant access to files until they expire. Treat those URLs and upload tokens as credentials: do not publish them or include them in analytics. See File Uploads for expiry periods and attachment rules.

Request only documented fields and parameters. Validation and access checks still apply when you use filters or field selection; neither can expand the key's permitted access.

Usage visibility and incident response​

Requidex records API usage with the key, endpoint, status, timing and access context. Administrators can review key usage and revoke credentials. In your own integration, record response status and request identifiers without storing secrets or unnecessary personal data.

If a key is exposed, revoke it, arrange a replacement and review its usage. Restrict or stop the affected integration until the replacement is configured. Provide the UTC time range, key name or prefix and request identifiers when asking for help; never include the full key.