Zquence is a multi-tenant platform. External integrations must preserve tenant isolation, environment isolation, auditability, and regional data-handling commitments.

​
Tenant and environment isolation

API keys resolve a single tenant from the key pair. Environment-bound keys resolve their own environmentId; a sandbox key cannot become a live key by sending a different x-environment-id header. Use sandbox keys for development, QA, SharePoint workflow tests, and BI dashboard prototyping. Use live keys only after live access is approved for the tenant.

​
Least-privilege scopes

Create separate keys per integration and assign only the scopes that integration needs.
ScopeUse
tenants.readRead current tenant profile and context metadata.
environments.readRead the environments visible to the API key.
accounts.readRead account records and invite metadata.
kyc.readRead KYC status, history, summaries, and exports.
document-reviews.readRead document review status.
document-reviews.writeRequest a general document from a specific tenant user.
source-of-funds.readRead source-of-funds records.
files.downloadDownload files through signed file endpoints.
tenant-users.writeProvision tenant users singly or in bulk.
invites.writeCreate tenant invitation workflows.
Rotate keys on a schedule and revoke keys immediately when an integration is retired.

​
Explicit API-key exposure

API-key access is enabled route by route. Exposed routes must declare an API-key scope. Routes that exist for the dashboard or admin console but do not declare API-key access reject API-key callers with 403 key_forbidden. There are no unscoped API-key routes. New enterprise API groups must add explicit scopes before rollout.

​
PII and regulated data

KYC, account, source-of-funds, sanctions, document-review, and contract APIs can contain personal data, financial-source data, or provider-derived compliance data. Store exports and webhook payloads according to your tenant retention policy and regional obligations.

​
Webhook verification

Verify every webhook signature before processing the payload. Store webhook event.id for idempotency so retries and manual replays do not create duplicate downstream records. Webhook endpoint management and delivery-retry APIs are dashboard/JWT-only until webhooks.read and webhooks.manage scopes are introduced. Outbound webhook delivery and signature verification are available today.

​
Internal-only surfaces

Do not build tenant integrations against super-admin provider credentials, provider cost management, tenant deletion, platform billing catalog mutation, or recovery mutation APIs. Those are platform operations, not tenant-facing external APIs.