Developer preview API v1

Sandbox only. No real funds moved. No production access is granted here. Access requirements

Credential modernisation

Replace long-lived API keys with scoped credentials

Move every caller from legacy API keys to revocable, scoped developer-app credentials managed in the secret manager.

Ownership and runbook

Owner: Platform Security. Runbook: RB-API-SECURITY-OPS-001. Move off long-lived API keys to scoped developer-app credentials with rotation and revocation.

API key replacement

Provision a developer-app credential for the same tenant and programme, migrate each caller, verify the replacement, then deactivate the legacy API key. The secret manager remains the only source of credential material.

Prohibited

Do not continue issuing new API keys, embed a legacy API key in a public client, or leave deactivated keys discoverable in configuration history.

Migration sequence

1. Provision developer-app credential for dapp_01900000000000000000000000
2. Migrate callers from the legacy API key
3. Verify each caller with the replacement
4. Deactivate the API key
5. Record the migration in RB-API-SECURITY-OPS-001