Security and identity
Available today
| Control | How |
|---|---|
| Authentication | API key X-API-Key (sha256), per-key scopes. |
| Origin restriction | IP allowlist (IPs/CIDRs) per key. |
| Validity | Expiration per key (expires_at) — per app/environment keys. |
| Role | alert_view bound to the key (authoritative; the header is just a hint). |
| Limits | Rate limit per organization (minute/month). |
| Anti-duplication | Idempotency-Key (replay not charged). |
| Webhooks | HMAC-SHA256 signature + timestamp; retry/log/replay. |
| Observability | X-Request-Id + traceparent (W3C/OpenTelemetry). |
| Isolation | Multi-tenant by organization_id. |
Distributed tracing (traceparent)
Send the traceparent header (W3C Trace Context); it is propagated back on the response
and correlated in logs, enabling end-to-end tracing.
curl -H "traceparent: 00-4bf92f3577b34da6a3ce929d0e0e4736-00f067aa0ba902b7-01" \
https://api.saubit.com.br/api/v1/health -i | grep -i traceparent
Key expiration (admin)
The admin sets expires_at when creating/updating the API key (Admin Swagger). After the date,
the key returns 403 (API key expirada). Combine with per app/environment keys.
Enterprise roadmap
OAuth2 Client Credentials, SMART Backend Services (signed JWT), mTLS, SSO OIDC/SAML + MFA,
RBAC/ABAC, SCIM, immutable logs/SIEM, SBOM, pentest and tested DR. Details in
SECURITY.md and planning/.
Vulnerability reports: security@saubit.com.br (responsible disclosure).