API product catalogEnterprise Governance, Security & Access

Get enterprise security controls

Enterprise Governance, Security & Access

GET

/security

Production onlygetEnterpriseSecurity

Returns the active enterprise security policy for the authenticated partner key, including IP allowlists, signed-request requirements, mTLS gateway requirements, scoped-key governance, rotation policy, and security evidence metadata.

Parameters

This endpoint has no path or query parameters.

Headers

AuthorizationstringRequired

Bearer sk_sandbox_<your_key> for sandbox requests.

Response fields

policyobject

policy.ipAllowliststring[]

Exact IP addresses or IPv4 CIDR ranges allowed to call this partner key. Empty means no IP restriction.

Example: ["203.0.113.10","198.51.100.0/24"]

policy.requireSignedRequestsboolean

Require HMAC-signed non-GET requests. Send X-MS-Timestamp (ISO-8601, within a 5-minute window) and X-MS-Signature = hex HMAC-SHA256(apiKey, "{timestamp}.{METHOD}.{path}{?query}.{sha256(body)}"). The signed path includes the query string (leading ?, empty when absent) so query-parameter tampering is detected. Signing without the query string is accepted for backward compatibility but deprecated.

Example: true

policy.requireMtlsboolean

Require upstream mTLS verification headers from the API gateway.

Example: false

policy.scopedKeysRequiredboolean

When true, API keys must carry explicit scopes — a key with no scopes is denied (403) rather than granted broad access. A key that should retain full access under this policy must hold the scope. When false (default), unscoped keys keep broad access.

Example: true

policy.keyRotationDaysinteger | null

Required API key rotation interval in days.

Example: 90

policy.oauthClientCredentialsEnabledboolean

Indicates OAuth client-credentials support is enabled for this partner.

Example: false

policy.soc2EvidenceUrlstring | null

HTTPS link to SOC 2 evidence or trust-center artifact.

policy.pentestEvidenceUrlstring | null

HTTPS link to penetration-test evidence.

policy.lastRotationAtstring | null

keyobject

key.keyIdstring

key.partnerIdstring

key.keyTypefull | data

key.scopesstring[]

key.requiredScopeForThisEndpointstring | null

key.rotationDueAtstring | null

signedRequestSpecobject

signedRequestSpec.headersstring[]

signedRequestSpec.algorithmstring

Example: "HMAC-SHA256"

signedRequestSpec.payloadstring

Example: "timestamp.method.path.sha256(raw_request_body)"

signedRequestSpec.timestampToleranceSecondsinteger

Example: 300

mtlsobject

mtls.acceptedGatewayHeadersstring[]

Response codes

200Active enterprise security policy.

Request reference

Production only

Use the API Reference for this production-only or streaming operation.

https://mystocks.africa/api/v1/partner/security

Open in API Tester API Reference

Response schema

{
  "type": "object",
  "properties": {
    "policy": {
      "type": "object",
      "properties": {
        "ipAllowlist": {
          "type": "array",
          "description": "Exact IP addresses or IPv4 CIDR ranges allowed to call this partner key. Empty means no IP restriction.",
          "items": {
            "type": "string"
          },
          "example": [
            "203.0.113.10",
            "198.51.100.0/24"
          ]
        },
        "requireSignedRequests": {
          "type": "boolean",
          "description": "Require HMAC-signed non-GET requests. Send `X-MS-Timestamp` (ISO-8601, within a 5-minute window) and `X-MS-Signature` = hex `HMAC-SHA256(apiKey, \"{timestamp}.{METHOD}.{path}{?query}.{sha256(body)}\")`. The signed path includes the query string (leading `?`, empty when absent) so query-parameter tampering is detected. Signing without the query string is accepted for backward compatibility but deprecated.",
          "example": true
        },
        "requireMtls": {
          "type": "boolean",
          "description": "Require upstream mTLS verification headers from the API gateway.",
          "example": false
        },
        "scopedKeysRequired": {
          "type": "boolean",
          "description": "When true, API keys must carry explicit scopes — a key with no scopes is denied (403) rather than granted broad access. A key that should retain full access under this policy must hold the `*` scope. When false (default), unscoped keys keep broad access.",
          "example": true
        },
        "keyRotationDays": {
          "type": [
            "integer",
            "null"
          ],
          "minimum": 30,
          "maximum": 365,
          "description": "Required API key rotation interval in days.",
          "example": 90
        },
        "oauthClientCredentialsEnabled": {
          "type": "boolean",
          "description": "Indicates OAuth client-credentials support is enabled for this partner.",
          "example": false
        },
        "soc2EvidenceUrl": {
          "type": [
            "string",
            "null"
          ],
          "format": "uri",
          "description": "HTTPS link to SOC 2 evidence or trust-center artifact."
        },
        "pentestEvidenceUrl": {
          "type": [
            "string",
            "null"
          ],
          "format": "uri",
          "description": "HTTPS link to penetration-test evidence."
        },
        "lastRotationAt": {
          "type": [
            "string",
            "null"
          ],
          "format": "date-time"
        }
      }
    },
    "key": {
      "type": "object",
      "properties": {
        "keyId": {
          "type": "string"
        },
        "partnerId": {
          "type": "string"
        },
        "keyType": {
          "type": "string",
          "enum": [
            "full",
            "data"
          ]
        },
        "scopes": {
          "type": "array",
          "items": {
            "type": "string"
          }
        },
        "requiredScopeForThisEndpoint": {
          "type": [
            "string",
            "null"
          ]
        },
        "rotationDueAt": {
          "type": [
            "string",
            "null"
          ],
          "format": "date-time"
        }
      }
    },
    "signedRequestSpec": {
      "type": "object",
      "properties": {
        "headers": {
          "type": "array",
          "items": {
            "type": "string"
          }
        },
        "algorithm": {
          "type": "string",
          "example": "HMAC-SHA256"
        },
        "payload": {
          "type": "string",
          "example": "timestamp.method.path.sha256(raw_request_body)"
        },
        "timestampToleranceSeconds": {
          "type": "integer",
          "example": 300
        }
      }
    },
    "mtls": {
      "type": "object",
      "properties": {
        "acceptedGatewayHeaders": {
          "type": "array",
          "items": {
            "type": "string"
          }
        }
      }
    }
  }
}

curl -X GET 'https://mystocks.africa/api/v1/partner/security' \
  -H "Authorization: Bearer $MYSTOCKS_API_KEY"

POST /oauth/token

PATCH /security