API product catalogEnterprise Governance, Security & Access

Update enterprise security controls

Enterprise Governance, Security & Access

PATCH

/security

Production onlyupdateEnterpriseSecurity

Updates partner-managed enterprise controls. A full API key is required. Once signed requests or mTLS are enabled, subsequent write requests must satisfy the configured controls.

Parameters

This endpoint has no path or query parameters.

Headers

AuthorizationstringRequired

Bearer sk_sandbox_<your_key> for sandbox requests.

Idempotency-KeystringheaderRequired

Unique string that makes write calls safe to retry on network failure. Required for money movement, trading, KYC, subscriptions, and webhook creation. Deduplicated for 24 hours -- duplicate keys return the cached response. HTTP 409 if a concurrent request with the same key is still in progress.

Example: dep_user42_1743152580

Request body

ipAllowliststring[]

Exact IP addresses or IPv4 CIDR ranges allowed to call this partner key. Empty means no IP restriction.

Example: ["203.0.113.10","198.51.100.0/24"]

requireSignedRequestsboolean

Require HMAC-signed non-GET requests. Send X-MS-Timestamp (ISO-8601, within a 5-minute window) and X-MS-Signature = hex HMAC-SHA256(apiKey, "{timestamp}.{METHOD}.{path}{?query}.{sha256(body)}"). The signed path includes the query string (leading ?, empty when absent) so query-parameter tampering is detected. Signing without the query string is accepted for backward compatibility but deprecated.

Example: true

requireMtlsboolean

Require upstream mTLS verification headers from the API gateway.

Example: false

scopedKeysRequiredboolean

When true, API keys must carry explicit scopes — a key with no scopes is denied (403) rather than granted broad access. A key that should retain full access under this policy must hold the scope. When false (default), unscoped keys keep broad access.

Example: true

keyRotationDaysinteger | null

Required API key rotation interval in days.

Example: 90

oauthClientCredentialsEnabledboolean

Indicates OAuth client-credentials support is enabled for this partner.

Example: false

soc2EvidenceUrlstring | null

HTTPS link to SOC 2 evidence or trust-center artifact.

pentestEvidenceUrlstring | null

HTTPS link to penetration-test evidence.

lastRotationAtstring | null

Response fields

messagestring

policyobject

policy.ipAllowliststring[]

Exact IP addresses or IPv4 CIDR ranges allowed to call this partner key. Empty means no IP restriction.

Example: ["203.0.113.10","198.51.100.0/24"]

policy.requireSignedRequestsboolean

Example: true

policy.requireMtlsboolean

Require upstream mTLS verification headers from the API gateway.

Example: false

policy.scopedKeysRequiredboolean

Example: true

policy.keyRotationDaysinteger | null

Required API key rotation interval in days.

Example: 90

policy.oauthClientCredentialsEnabledboolean

Indicates OAuth client-credentials support is enabled for this partner.

Example: false

policy.soc2EvidenceUrlstring | null

HTTPS link to SOC 2 evidence or trust-center artifact.

policy.pentestEvidenceUrlstring | null

HTTPS link to penetration-test evidence.

policy.lastRotationAtstring | null

Response codes

200Updated enterprise security policy.

Request reference

Production only

Use the API Tester for write requests, including request bodies and idempotency keys.

https://mystocks.africa/api/v1/partner/security

Open in API Tester API Reference

Response schema

{
  "type": "object",
  "properties": {
    "message": {
      "type": "string"
    },
    "policy": {
      "type": "object",
      "properties": {
        "ipAllowlist": {
          "type": "array",
          "description": "Exact IP addresses or IPv4 CIDR ranges allowed to call this partner key. Empty means no IP restriction.",
          "items": {
            "type": "string"
          },
          "example": [
            "203.0.113.10",
            "198.51.100.0/24"
          ]
        },
        "requireSignedRequests": {
          "type": "boolean",
          "description": "Require HMAC-signed non-GET requests. Send `X-MS-Timestamp` (ISO-8601, within a 5-minute window) and `X-MS-Signature` = hex `HMAC-SHA256(apiKey, \"{timestamp}.{METHOD}.{path}{?query}.{sha256(body)}\")`. The signed path includes the query string (leading `?`, empty when absent) so query-parameter tampering is detected. Signing without the query string is accepted for backward compatibility but deprecated.",
          "example": true
        },
        "requireMtls": {
          "type": "boolean",
          "description": "Require upstream mTLS verification headers from the API gateway.",
          "example": false
        },
        "scopedKeysRequired": {
          "type": "boolean",
          "description": "When true, API keys must carry explicit scopes — a key with no scopes is denied (403) rather than granted broad access. A key that should retain full access under this policy must hold the `*` scope. When false (default), unscoped keys keep broad access.",
          "example": true
        },
        "keyRotationDays": {
          "type": [
            "integer",
            "null"
          ],
          "minimum": 30,
          "maximum": 365,
          "description": "Required API key rotation interval in days.",
          "example": 90
        },
        "oauthClientCredentialsEnabled": {
          "type": "boolean",
          "description": "Indicates OAuth client-credentials support is enabled for this partner.",
          "example": false
        },
        "soc2EvidenceUrl": {
          "type": [
            "string",
            "null"
          ],
          "format": "uri",
          "description": "HTTPS link to SOC 2 evidence or trust-center artifact."
        },
        "pentestEvidenceUrl": {
          "type": [
            "string",
            "null"
          ],
          "format": "uri",
          "description": "HTTPS link to penetration-test evidence."
        },
        "lastRotationAt": {
          "type": [
            "string",
            "null"
          ],
          "format": "date-time"
        }
      }
    }
  }
}

curl -X PATCH 'https://mystocks.africa/api/v1/partner/security' \
  -H "Authorization: Bearer $MYSTOCKS_API_KEY" \
  -H "Idempotency-Key: YOUR_UNIQUE_REQUEST_ID" \
  -H "Content-Type: application/json" \
  -d '{
  "ipAllowlist": [
    "203.0.113.10"
  ],
  "requireSignedRequests": true,
  "keyRotationDays": 90
}'

GET /security

DELETE /sessions