{"templateId":"markdown","sharedDataIds":{"sidebar":"sidebar-products/namirialnotify/sidebars.yaml"},"props":{"metadata":{"markdoc":{"tagList":["admonition"]},"type":"markdown"},"seo":{"title":"Security and authentication","description":"Integration and usage documentation.","llmstxt":{"hide":false,"sections":[{"title":"Table of contents","includeFiles":["**/*"],"excludeFiles":[]}],"excludeFiles":[]}},"dynamicMarkdocComponents":[],"compilationErrors":[],"ast":{"$$mdtype":"Tag","name":"article","attributes":{},"children":[{"$$mdtype":"Tag","name":"Heading","attributes":{"level":1,"id":"security-and-authentication","__idx":0},"children":["Security and authentication"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Namirial Notify APIs use HTTP Basic authentication. This guide summarizes the"," ","cross-service security practices that matter when you move from test"," ","integrations to production operations."]},{"$$mdtype":"Tag","name":"hr","attributes":{},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"authentication-model","__idx":1},"children":["Authentication model"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The API references define:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Authentication scheme"]},": HTTP Basic authentication"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Production base URL"]},": ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["https://api.evicertia.com"]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Pre-production / QA base URL"]},": ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["https://api.ecertia.com"]}]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Use the credentials provided for your organisation, environment, and enabled"," ","services."]},{"$$mdtype":"Tag","name":"Admonition","attributes":{"type":"warning"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Do not reuse pre-production assumptions in production. Validate credentials,"," ","enabled services, and environment details before go-live."]}]},{"$$mdtype":"Tag","name":"hr","attributes":{},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"credential-handling","__idx":2},"children":["Credential handling"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Store credentials in a secret manager or equivalent protected configuration"," ","store."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Keep separate credentials and configuration for pre-production and production."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Never hard-code credentials in source control, collections, or examples that"," ","will be shared externally."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Rotate credentials promptly when team ownership changes or exposure is"," ","suspected."]}]},{"$$mdtype":"Tag","name":"hr","attributes":{},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"request-security","__idx":3},"children":["Request security"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Send API requests only over HTTPS."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Treat request payloads, attachments, affidavits, and ZIP downloads as"," ","sensitive business records."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Scan and validate user-supplied email content and attachments before"," ","submission. Namirial Notify does not scan or block submitted email content for"," ","viruses or malware; the sender is responsible for the content it submits."," ","Recipient mail systems may apply their own security controls, but integrations"," ","should not rely on those controls."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Avoid logging full base64 documents, attachment blobs, or affidavit blobs."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Use ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["LookupKey"]}," and other correlation fields for tracing instead of copying"," ","full payloads into logs."]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Use ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["X-Evi-IdempotencyToken"]}," on Submit requests for all services (EviMail, EviSMS,"," ","EviNotice, EviPost) so a retry does not accidentally create a duplicate transaction."]},{"$$mdtype":"Tag","name":"hr","attributes":{},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"callback-endpoint-hardening","__idx":4},"children":["Callback endpoint hardening"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The callback documentation requires your ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["PushNotificationUrl"]}," to be publicly"," ","reachable. When exposing that endpoint:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Serve it over HTTPS."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Accept only the method and content type your integration expects."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Validate the JSON payload shape before processing business logic."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Make processing idempotent by storing callback identifiers and rejecting"," ","duplicates safely."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Record ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["EvidenceId"]},", event type, and callback identifier for traceability."]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Namirial Notify sends callbacks as HTTP ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["POST"]}," requests with JSON payloads."," ","The callback integration model does not define callback authentication through"," ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Authorization"]}," headers, HMAC signatures, or shared-secret headers."]},{"$$mdtype":"Tag","name":"Admonition","attributes":{"type":"info"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Namirial Notify defines callback payloads and retry behavior, but it does not"," ","define signed callback verification or a stable source-IP allowlist for origin"," ","validation. If you need stronger origin controls, front the endpoint with your"," ","own API gateway or network controls and confirm the supported model with your"," ","Namirial Notify contact."]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Recommended receiver behavior:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Return ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["200 OK"]}," after your system has validated the payload and safely stored"," ","or queued the event for processing."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Treat the callback body as untrusted input until schema validation passes."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Use observed source IPs only as an operational signal unless Namirial Notify"," ","explicitly confirms a stable allowlist for your environment."]}]},{"$$mdtype":"Tag","name":"hr","attributes":{},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"data-minimization","__idx":5},"children":["Data minimization"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Request affidavit blobs, attachment blobs, or document content only in the"," ","steps that actually need the files."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Prefer metadata-only query modes during normal tracking."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Delete temporary download files and transient processing artifacts when they"," ","are no longer needed by your business or compliance process."]}]},{"$$mdtype":"Tag","name":"hr","attributes":{},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"operational-security-checks-before-go-live","__idx":6},"children":["Operational security checks before go-live"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Verify the target base URL for the environment."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Verify that the expected services are enabled for the account."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Verify that callback URLs are reachable from the public internet."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Verify that your system can handle callback retries without duplicate side"," ","effects."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Verify how support will use ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["RequestId"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Instance"]},", or similar identifiers"," ","during incident handling."]}]},{"$$mdtype":"Tag","name":"hr","attributes":{},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"related","__idx":7},"children":["Related"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"a","attributes":{"href":"/products/namirialnotify/dev/api-documentation"},"children":["API documentation"]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"a","attributes":{"href":"/products/namirialnotify/dev/callbacks"},"children":["Callbacks and webhooks"]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"a","attributes":{"href":"/products/namirialnotify/dev/error-handling"},"children":["Error handling"]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"a","attributes":{"href":"/products/namirialnotify/dev/performance-guidelines"},"children":["Performance and scaling"]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"a","attributes":{"href":"/products/namirialnotify/apis/overview"},"children":["API reference overview"]}]}]}]},"headings":[{"value":"Security and authentication","id":"security-and-authentication","depth":1},{"value":"Authentication model","id":"authentication-model","depth":2},{"value":"Credential handling","id":"credential-handling","depth":2},{"value":"Request security","id":"request-security","depth":2},{"value":"Callback endpoint hardening","id":"callback-endpoint-hardening","depth":2},{"value":"Data minimization","id":"data-minimization","depth":2},{"value":"Operational security checks before go-live","id":"operational-security-checks-before-go-live","depth":2},{"value":"Related","id":"related","depth":2}],"frontmatter":{"title":"Security and authentication","description":"Authentication guidance and integration security recommendations for the Namirial Notify APIs.","layout":"doc","outline":"deep","keywords":["security","authentication","basic auth","webhook security","namirial notify api"],"seo":{"title":"Security and authentication"}},"lastModified":"2026-08-03T09:08:16.000Z","pagePropGetterError":{"message":"","name":""}},"slug":"/products/namirialnotify/dev/security-best-practices","userData":{"isAuthenticated":false,"teams":["anonymous"]},"isPublic":true}