API integration and security

Full video transcript

Your manufacturing or service system already knows when something happens to a product. An integration should carry the right fact into OriginSpan without losing identity, permissions, or the outcome. This episode describes a reference API workflow, from a source record to a confirmed result. The exact endpoints, credentials, and connector scope must be agreed for the deployment.

Define the contract before writing the connector. Which system owns each field? Which product, batch, or item is being referenced? What units, time zones, and event meanings are expected? Map a real example and an invalid example. A successful network request does not prove that two systems understood the same business fact.

Use the supported authentication method for the integration and grant only the required permissions. Keep secrets in protected server side storage, outside public pages, repositories, and logs. Plan rotation and revocation. A valid credential identifies a caller; the service must still authorize its organization, target record, and requested action. Never use a supplied organization identifier as permission by itself.

Validate incoming data and the relationships it names. Reject unsupported fields or invalid values according to the contract. Check that an item belongs to the expected product and organization. Keep scan resolution separate from commands that change records. In our example, reading a jacket's QR code locates information; recording its inspection is a separate authorized operation.

Handle timeouts without creating duplicate business events. If a response is lost, the sender may not know whether the command was accepted. For operations that support an idempotency key, retry the same request with the same key and unchanged content. Treat a changed request as a different operation. Preserve accepted references and resolve conflicts before continuing.

For asynchronous notifications, verify the documented signature and freshness rules where supported. Expect duplicates and possible changes in arrival order. An event notification is not an instruction to trust arbitrary external data. Record what was processed, monitor failed work, and reconcile against the authoritative state. Test expired credentials, denied access, duplicates, and unavailable dependencies before rollout.

Start with one source system and one bounded workflow. Agree volume, limits, ownership, error handling, and the evidence that proves acceptance. OriginSpan's integration options are scoped to the customer's systems and deployment; this walkthrough does not imply that every connector or endpoint is already enabled. Bring a sample payload to a demonstration using the booking link below.