Skip to content

v0.1.0 - External API reference architecture documentation milestone

Choose a tag to compare

View all tags
@ktalpay ktalpay released this 01 May 16:41
· 43 commits to main since this release
v0.1.0
fa1a2a1
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

v0.1.0 Release Notes

Summary

v0.1.0 is the first documentation milestone for the fintech external API reference architecture. It collects the core models, example contracts, threat model, and architecture decisions needed to review company-scoped external API access.

Included documentation

  • Problem statement
  • Architecture overview
  • Security boundaries
  • Company-scoped API key model
  • Scope and permission model
  • Audit log model
  • Rate limiting and abuse detection model
  • Token lifecycle and revocation model
  • External API contract examples
  • Threat model
  • ADR-0001 through ADR-0006

Architecture decisions included

  • ADR-0001: Use company-scoped API keys for external API access.
  • ADR-0002: Use append-only audit events for external API access.
  • ADR-0003: Use layered rate limiting for external API access.
  • ADR-0004: Use explicit token lifecycle and revocation controls.
  • ADR-0005: Use explicit external API contracts.
  • ADR-0006: Use a threat model for external API boundaries.

What is intentionally not included

  • Application code
  • Production deployment
  • Cloud-specific implementation
  • Legal/compliance mapping
  • OpenAPI/YAML contract
  • SDKs or client libraries
  • Automated tests

Next possible increments

  • OpenAPI example file
  • Integration guide
  • Error code reference
  • Webhook delivery model
  • Sequence diagrams
  • Implementation-neutral checklist
  • Sample review worksheet

Notes

This release is a documentation milestone, not a production implementation.

Assets 2
Loading