İçeriğe atla
Ön GörüşmeDemo Talep Et
Identity & Digital Trust Pro · Yetenek raporuBölüm 11 / 17

API Sözleşmeleri ve Protokol Güvenliği — Trust Pro Identity & Digital Trust

API Sözleşmeleri ve Protokol Güvenliği: GET /v1/principals, GET /v1/principals/{id}/effective-access, POST /v1/access-requests, POST /v1/approvals/{id}/decision, POST /v1/jit-grants ve diğerleri.

Rapor bölümleri · 11/17
API / KAYNAKSÖZLEŞME, GÜVENLİK VE SINIR
GET /v1/principalsTenant-scope, principal type, source confidence, paginated fields, privacy filtering
GET /v1/principals/{id}/effective-accessRBAC/ABAC inheritance, source, time validity, policy simulation evidence
POST /v1/access-requestsRequest, ticket, purpose, resource, TTL, requester/owner conflict checks
POST /v1/approvals/{id}/decisionStep-up authentication, reviewer scope, signed decision and audit
POST /v1/jit-grantsShort-lived privilege, resource scope, approval, idempotency, expiry
POST /v1/sessions/revokeRevocation intent, selected devices, authorization and delivery status
GET /v1/itdr/casesEvidence references, identities, severity, containment and scope
POST /v1/agents/{id}/delegationsHuman sponsor, allowed tool/actions, audience, TTL, consent and approval
POST /v1/policy/evaluateSubject/resource/action/context, policy version, explanation, deny-by-default
POST /v1/policy/simulateDry-run decisions, scope changes, denied/allowed difference and rollout
POST /v1/credential/verifySigned credential proof/status/issuer; minimum claim disclosure
GET /v1/evidence/exportsScoped, time-bound audit package; watermark and expiry
POST /v1/connectors/reconcileSource cursor, target actual state, drift count, review status
POST /v1/identity-proofing/casesEnrollment purpose, consent/legal basis, review and retention class

Temel event sözlüğü

EVENT NAMEGEREKLİ KANIT ALANLARI
PrincipalCreatedevent_id, tenant_id, principal/reference, occurred_at, effective_at, producer, correlation_id, policy_version, signature/hash
PrincipalLinkedevent_id, tenant_id, principal/reference, occurred_at, effective_at, producer, correlation_id, policy_version, signature/hash
EmploymentMovedevent_id, tenant_id, principal/reference, occurred_at, effective_at, producer, correlation_id, policy_version, signature/hash
PrincipalDisabledevent_id, tenant_id, principal/reference, occurred_at, effective_at, producer, correlation_id, policy_version, signature/hash
EntitlementAssignedevent_id, tenant_id, principal/reference, occurred_at, effective_at, producer, correlation_id, policy_version, signature/hash
EntitlementRevokedevent_id, tenant_id, principal/reference, occurred_at, effective_at, producer, correlation_id, policy_version, signature/hash
AccessRequestApprovedevent_id, tenant_id, principal/reference, occurred_at, effective_at, producer, correlation_id, policy_version, signature/hash
JITGrantStartedevent_id, tenant_id, principal/reference, occurred_at, effective_at, producer, correlation_id, policy_version, signature/hash
JITGrantExpiredevent_id, tenant_id, principal/reference, occurred_at, effective_at, producer, correlation_id, policy_version, signature/hash
CredentialBoundevent_id, tenant_id, principal/reference, occurred_at, effective_at, producer, correlation_id, policy_version, signature/hash
CredentialRevokedevent_id, tenant_id, principal/reference, occurred_at, effective_at, producer, correlation_id, policy_version, signature/hash
PasskeyRegisteredevent_id, tenant_id, principal/reference, occurred_at, effective_at, producer, correlation_id, policy_version, signature/hash
AuthenticationRiskRaisedevent_id, tenant_id, principal/reference, occurred_at, effective_at, producer, correlation_id, policy_version, signature/hash
SessionRevokedevent_id, tenant_id, principal/reference, occurred_at, effective_at, producer, correlation_id, policy_version, signature/hash
OAuthGrantSuspiciousevent_id, tenant_id, principal/reference, occurred_at, effective_at, producer, correlation_id, policy_version, signature/hash
NHISecretRotatedevent_id, tenant_id, principal/reference, occurred_at, effective_at, producer, correlation_id, policy_version, signature/hash
AgentDelegationCreatedevent_id, tenant_id, principal/reference, occurred_at, effective_at, producer, correlation_id, policy_version, signature/hash
AgentActionDeniedevent_id, tenant_id, principal/reference, occurred_at, effective_at, producer, correlation_id, policy_version, signature/hash
IdentityIncidentOpenedevent_id, tenant_id, principal/reference, occurred_at, effective_at, producer, correlation_id, policy_version, signature/hash
TrustAnchorRevokedevent_id, tenant_id, principal/reference, occurred_at, effective_at, producer, correlation_id, policy_version, signature/hash

Protokol ve API güvenliği

  • OAuth/OIDC: Authorization Code + PKCE, nonce/state, redirect allowlist, issuer/audience ve token expiry doğrulaması.
  • SAML: Signature wrapping ve XML canonicalization riskine karşı doğrulanmış parser, tek audience ve replay sınırları.
  • SCIM: Idempotency, ETag/If-Match ve kaynak otoritesi eşleştirme; silme için iki aşamalı politika.
  • FIDO2: Challenge origin/RP ID, authenticator assurance ve credential lifecycle doğrulaması.
  • SPIFFE: Workload attestation, kısa ömürlü identity, trust domain ve federation revocation politikaları.
  • PDP: Deny-by-default, permission cache revocation, negative scope ve fail-closed profilleri.