Data access
What data can an integration access?
An integration can discover and retrieve only active tally tags marked for export, within its approved customer, site, and line scope. Platform-managed policy also controls the lookback window, raw or aggregate access, minimum aggregation interval, result limits, and available downtime data.
Why is an exportable tag missing from discovery?
Confirm that the tag is active, marked for export, associated with a reachable machine, and inside the integration's site and line scope. The approved data source must also be enabled. Run discovery again after an operator changes any of those settings.
Can an integration request raw data?
Only when a platform operator enables raw access for the approved data source. Otherwise, the API returns aggregates using at least the configured minimum interval. Clients cannot override that policy with query parameters.
Requests and limits
Why did the API return 403?
A 403 means the authenticated integration is not permitted to perform that request. Use discovery to confirm the reachable site, line, machine, tag, and operation. Do not probe neighboring identifiers, because resources outside the integration's scope intentionally remain unavailable.
How do pages affect the daily request allowance?
Every returned data page consumes one request from the integration's daily UTC allowance. A smaller pageSize can therefore consume the allowance faster. Follow nextCursor exactly and avoid restarting a query unless its filters need to change.
What should a client do after receiving 429?
Honor the response's Retry-After value and wait until the indicated UTC reset. Do not retry continuously. If the allowance is routinely insufficient, ask a platform operator to review the integration's usage and approved limit.
Authentication
Which authentication method should we choose?
Use OIDC OAuth 2.0 when your application can securely manage a client credential and request short-lived tokens. Use mTLS when certificate-bound machine identity fits your infrastructure. Use signed JWT when your system already manages an approved signing key and certificate. All methods are passwordless from the end user's perspective.
How do we replace an expired or compromised credential?
Open Dashboard -> Settings -> Customer API, select the integration, and renew or replace the affected authentication method. Revoke a suspected credential before distributing its replacement. Never send private keys, bearer tokens, or generated packages through a support ticket.
Getting help
Before contacting support, record the UTC timestamp, request path without sensitive query content, HTTP status, and correlation identifier. Include those details with a short description of the expected behavior, but never include credentials or private certificate material.