Least privilege
Create a separate integration for each application or operational owner. This keeps access boundaries clear and allows one integration to be suspended or rotated without disrupting unrelated clients. Grant only the scopes, sites, and lines that application needs. Empty site or line restrictions can represent broad customer access, so review them deliberately before activating an integration.
The API returns only active tags that have been marked exportable. Authorization is an additional control, not a substitute for correctly classifying tags. Access to raw data, filtering and aggregation options, lookback windows, result counts, and daily page allowances is governed by platform policy rather than by the client.
Credential handling
Store OAuth secrets, JWTs, certificate private keys, and downloaded packages in an approved secret store. For mTLS, generate the private key where it will be used, keep it non-exportable where possible, and register only the public certificate with Wavac. Rotate credentials when ownership changes, when exposure is suspected, and according to your organization's security policy. Remove authentication methods that are no longer used.
Never expose credentials through:
- URLs or source control
- Container images or deployment artifacts
- Tickets, screenshots, analytics, or application logs
Transport and validation
Use HTTPS for every request and always validate the server certificate and hostname. Disabling TLS verification makes credentials and returned data vulnerable even in a test environment, so examples and production clients should use the operating system's trusted certificate authorities.
OIDC clients should discover the token endpoint from the approved issuer and treat an unexpected issuer change as a configuration error. JWT authentication validates the signature, issuer, audience, lifetime, revocable identifier, and current integration policy. mTLS connections use the dedicated endpoint so the client certificate and its revocation status can be evaluated at the correct trust boundary.
Safe client behavior
Use discovery to learn which resources the integration can access rather than guessing identifiers. A 403 is a policy decision, not a signal to try neighboring identifiers. Treat pagination cursors as opaque and preserve the original query shape while paging.
When the API returns Retry-After, wait for the specified interval. Temporary failures should use bounded exponential backoff with jitter rather than unlimited retries. Data returned by the API remains production data, so apply retention, encryption, and access controls appropriate for tally and downtime records after retrieval.
Logs and support
Useful diagnostic logs include the UTC timestamp, endpoint path without sensitive query content, HTTP status, duration, result count, and returned correlation identifier. Authorization headers, cookies, tokens, secrets, certificate private material, and package contents must be redacted before a log or support artifact is stored.
If an integration may be compromised, disable or revoke it first. Rotate the affected authentication method, preserve sanitized audit evidence, and notify your Wavac support contact without attaching the credential itself.