Authenticate identity, then validate membership
Operational endpoints require a validated bearer token. The API resolves the identity's active organization memberships and checks requested access. X-Organization-Id selects among permitted memberships when needed; it does not grant access. Request-supplied tenantId and actor fields are rejected rather than trusted.
- GET /v1/me: inspect the authenticated identity's resolved memberships.
- GET /v1/cases and GET /v1/cases/:id/timeline: authorized case context.
- GET /v1/exceptions: authorized exception records.
Keep status changes and evidence together
The local platform processes simulated adapter events with carrier ownership, lifecycle, replay, and ordering checks. State changes, audit records, and downstream outbox entries are persisted transactionally. Carrier message identifiers support duplicate handling; correlation references connect the resulting activity.
- POST /v1/adapters/:carrierId/events: operations-authorized simulator event ingestion.
- POST /v1/exceptions/scan: evaluate conditions without duplicate open exceptions.
- POST /v1/exceptions/:id/resolve: permission-checked resolution with a reason.
Confirm the environment before integration
Use the platform repository README for local setup, migrations, configuration, and regression evidence. A production evaluation must confirm identity-provider settings, resource permissions, API error behavior, delivery responsibilities, and monitoring. The simulator endpoint is not a signed public carrier webhook; external webhook verification and authorized carrier access require their own integration contract.