Least privilege
Create a separate integration for each application or owning team. This keeps access boundaries clear and allows one integration to be suspended or rotated without disrupting unrelated clients. Grant only the scopes, sites, and lines that application needs. Empty site or line restrictions can represent broad customer access, so review them deliberately before activating an integration.
The API returns only active tags that have been marked exportable. Authorization is an additional control, not a substitute for correctly classifying tags. Filtering and aggregation options, lookback windows, result counts, and daily page allowances are defined by the integration's access settings rather than by the client.
Credential handling
Store signing keys, access tokens, enrollment tokens, certificate private keys, and downloaded test packages in an approved secret store. Generate private keys where they will be used and keep them non-exportable where the TLS client supports remote signing. Wavac platform-managed enrollment accepts a CSR and returns a 24-hour public certificate chain; customer-managed enrollment accepts only a public signing JWK. Rotate credentials when ownership changes or exposure is suspected.
Never expose credentials through:
- URLs or source control
- Container images or deployment artifacts
- Tickets, screenshots, analytics, or application logs
Transport and validation
Use HTTPS for every request and always validate the server certificate and hostname. Disabling TLS verification makes credentials and returned data vulnerable even in a test environment, so examples and production clients should use the operating system's trusted certificate authorities.
Platform-managed integrations present the active certificate on the dedicated endpoint for both token exchange and API requests. Customer-managed integrations sign a fresh client assertion for each token exchange and never send it as a Bearer token. Access tokens come only from the documented token endpoint.
Safe client behavior
Use discovery to learn which resources the integration can access rather than guessing identifiers. A 403 is a policy decision, not a signal to try neighboring identifiers. Treat pagination cursors as opaque and preserve the original query shape while paging.
When the API returns Retry-After, wait for the specified interval. Temporary failures should use bounded exponential backoff with jitter rather than unlimited retries. Data returned by the API remains production data, so apply retention, encryption, and access controls appropriate for tally and downtime records after retrieval.
Logs and support
Useful diagnostic logs include the UTC timestamp, endpoint path without sensitive query content, HTTP status, duration, result count, and returned correlation identifier. Authorization headers, cookies, tokens, secrets, certificate private material, and package contents must be redacted before a log or support artifact is stored.
If an integration may be compromised, disable or revoke it first. Rotate the affected credential, preserve sanitized audit evidence, and notify your Wavac support contact without attaching credential material.
These controls follow the current OAuth 2.0 Security Best Current Practice (RFC 9700). The Wavac authentication articles define the exact credentials and endpoints supported by the Customer API.