v0.3.0

v0.3.0 — Documentation hardening release

This release strengthens the repository as a documentation-first reference architecture for secure external API access in fintech-style platforms.

Highlights

• Added request-flow diagrams for successful requests, invalid key handling, scope denial, and rate-limit denial.
• Aligned the canonical threat model with the grouped documentation structure.
• Refined API key lifecycle documentation around creation, one-time display, hashing boundaries, ownership, expiry, revocation, and rotation.
• Clarified the distinction between company ownership and permission scopes.
• Aligned auditability and rate limiting documentation with request-flow behavior.
• Reviewed the illustrative OpenAPI contract for X-Api-Key, token-owner company scope, and stable error behavior.
• Aligned external error-code documentation with the OpenAPI sample.
• Cleaned up the ADR index and navigation.
• Added a v0.3.0 consistency-check note covering public wording, links, OpenAPI YAML parsing, navigation, and terminology.

Scope

This is a non-production reference architecture and documentation artifact. It does not provide a production implementation, compliance guarantee, certification, or deployment-ready system.

Suggested reading path

1. README
2. Documentation index
3. Architecture overview
4. Request-flow diagrams
5. Threat model
6. API key lifecycle
7. Scope and permission model
8. Auditability model
9. Rate limiting and abuse detection
10. Illustrative OpenAPI contract