# Security and authentication

Namirial Notify APIs use HTTP Basic authentication. This guide summarizes the
cross-service security practices that matter when you move from test
integrations to production operations.

## Authentication model

The API references define:

- **Authentication scheme**: HTTP Basic authentication
- **Production base URL**: `https://api.evicertia.com`
- **Pre-production / QA base URL**: `https://api.ecertia.com`


Use the credentials provided for your organisation, environment, and enabled
services.

Do not reuse pre-production assumptions in production. Validate credentials,
enabled services, and environment details before go-live.

## Credential handling

- Store credentials in a secret manager or equivalent protected configuration
store.
- Keep separate credentials and configuration for pre-production and production.
- Never hard-code credentials in source control, collections, or examples that
will be shared externally.
- Rotate credentials promptly when team ownership changes or exposure is
suspected.


## Request security

- Send API requests only over HTTPS.
- Treat request payloads, attachments, affidavits, and ZIP downloads as
sensitive business records.
- Scan and validate user-supplied email content and attachments before
submission. Namirial Notify does not scan or block submitted email content for
viruses or malware; the sender is responsible for the content it submits.
Recipient mail systems may apply their own security controls, but integrations
should not rely on those controls.
- Avoid logging full base64 documents, attachment blobs, or affidavit blobs.
- Use `LookupKey` and other correlation fields for tracing instead of copying
full payloads into logs.


Use `X-Evi-IdempotencyToken` on Submit requests for all services (EviMail, EviSMS,
EviNotice, EviPost) so a retry does not accidentally create a duplicate transaction.

## Callback endpoint hardening

The callback documentation requires your `PushNotificationUrl` to be publicly
reachable. When exposing that endpoint:

- Serve it over HTTPS.
- Accept only the method and content type your integration expects.
- Validate the JSON payload shape before processing business logic.
- Make processing idempotent by storing callback identifiers and rejecting
duplicates safely.
- Record `EvidenceId`, event type, and callback identifier for traceability.


Namirial Notify sends callbacks as HTTP `POST` requests with JSON payloads.
The callback integration model does not define callback authentication through
`Authorization` headers, HMAC signatures, or shared-secret headers.

Namirial Notify defines callback payloads and retry behavior, but it does not
define signed callback verification or a stable source-IP allowlist for origin
validation. If you need stronger origin controls, front the endpoint with your
own API gateway or network controls and confirm the supported model with your
Namirial Notify contact.

Recommended receiver behavior:

- Return `200 OK` after your system has validated the payload and safely stored
or queued the event for processing.
- Treat the callback body as untrusted input until schema validation passes.
- Use observed source IPs only as an operational signal unless Namirial Notify
explicitly confirms a stable allowlist for your environment.


## Data minimization

- Request affidavit blobs, attachment blobs, or document content only in the
steps that actually need the files.
- Prefer metadata-only query modes during normal tracking.
- Delete temporary download files and transient processing artifacts when they
are no longer needed by your business or compliance process.


## Operational security checks before go-live

- Verify the target base URL for the environment.
- Verify that the expected services are enabled for the account.
- Verify that callback URLs are reachable from the public internet.
- Verify that your system can handle callback retries without duplicate side
effects.
- Verify how support will use `RequestId`, `Instance`, or similar identifiers
during incident handling.


## Related

- [API documentation](/products/namirialnotify/dev/api-documentation)
- [Callbacks and webhooks](/products/namirialnotify/dev/callbacks)
- [Error handling](/products/namirialnotify/dev/error-handling)
- [Performance and scaling](/products/namirialnotify/dev/performance-guidelines)
- [API reference overview](/products/namirialnotify/apis/overview)