API authentication and authorization
OAuth scopes govern API access; tenant/project and records policy still govern business authorization.
Final sources tied to business decisions
Proposed profile
OAuth 2.0 client credentials for service clients; OIDC for user applications under SSO configuration. Bearer tokens require valid issuer, audience, expiry and scopes. mTLS may bind clients when configured/tested.
Required context
Examples use X-Tenant-Id, X-Project-Id and X-Correlation-Id. Backends must match context to token authority rather than trust headers. records:read does not imply redaction, export or declaration.
Credential lifecycle
Approve minimal scopes, store secrets safely, test rotation overlap, revoke and audit. Use 401 for invalid authentication and 403 for insufficient permission. Never log tokens/secrets or record content.
Continue the workflow
Two journeys, one records lifecycle
Connect paper and born-digital records through persistent identifiers, policies and evidence.
Read detailsIntegration quickstart
Exercise ingest → job tracking → registration → verification with synthetic data.
Read detailsIntegrity, provenance and evidence
Each evidence type answers a different question; hashes, timestamps and approvals are not interchangeable.
Read detailsStart with a verifiable scope.
Agree record classes, quality criteria, permissions and evidence before scaling.
Plan assessment