API Security and Technical Reference

API Security and Technical Reference

This topic provides a technical overview of the security controls in place for the Rant & Rave APIs, including authentication, access control, credential management, and infrastructure security. It is intended for IT managers, security architects, and data protection teams conducting vendor assessments or completing DPIA documentation.

For developer documentation on individual APIs, see the API Documentation section of the Help Centre.

Authentication

All HTTP-based API endpoints (Return, Solicitation REST, Digital/CCI, Recover) use HTTP Basic Authentication, with credentials transmitted in the Authorization request header. All communication is encrypted in transit — credentials are never sent in plain text.

The Solicitation SFTP path authenticates at the session level using SSH.

System User Accounts

API access is granted through System User accounts — a dedicated account type within the Rant & Rave platform created specifically for machine-to-machine integrations.

Key properties:

• Separate from interactive accounts. System User credentials are not shared with user login accounts and are managed independently.

• Purpose-specific. Each System User account is created for a defined integration. A separate account can be provisioned for each distinct integration or consuming system, ensuring credential isolation.

• Feature-controlled. Access to each API must be explicitly enabled on a System User account during provisioning. An account without the relevant access enabled will be rejected even with valid credentials.

• Independently revocable. A System User account can be disabled at any time, immediately revoking all access, without affecting any other account.

System User credentials are delivered securely to customers via SendSafely — an end-to-end encrypted delivery platform.

Transport Security

Access Control

Authentication alone does not grant data access. Every authenticated request is additionally checked by the Permissions system before any data is returned.

API-level access

Each API requires a specific access permission to be enabled on the System User account. Accounts without the relevant permission are rejected with HTTP 403 even if credentials are valid.

Data access scoping (Return API)

The Return API supports two levels of data restriction per System User account:

• Field-level: A System User account is configured to return only the specific data fields relevant to the integration. Fields that have not been granted will not appear in responses.

• Record-level: A System User account may be configured with a data expression — a filter restricting which feedback records the integration can retrieve. For example, access may be scoped to a specific region, team, or product line.

Both levels are configured by Mobile Commons at provisioning and can be adjusted on request.

Project isolation

System User accounts are scoped to specific projects. Access to data across multiple projects requires explicit configuration.

Credential Management

Credential security

System User credentials should be treated as sensitive secrets:

• Store credentials in a secrets manager, vault, or equivalent secure storage — not in plain text files.

• Do not include credentials in source code or configuration files committed to version control.

• Do not write credentials to application or debug logs.

• Restrict access to credentials to only the systems and personnel that require them.

Revocation

System User accounts can be disabled immediately on request, revoking all API access instantly. Any subsequent requests using the revoked credentials will be rejected. Contact Support immediately if credentials are suspected to have been compromised.

Rotation

Credentials do not expire automatically. Periodic rotation is recommended — at minimum annually, or immediately upon suspicion of compromise, or when personnel with access to credentials leave the organisation.

Rotation requires coordination between both parties: Mobile Commons provisions and delivers new credentials securely, the integration is updated, and the old credentials are deactivated. Contact your Customer Success Manager to arrange a rotation. For integrations handling personal data, a formal rotation schedule should be agreed.