Skip to main content

​
Platform Security Standards

​
Transport Security

  • Use HTTPS with TLS 1.2 or later for API and webhook traffic
  • Validate the complete certificate chain and hostname
  • Keep certificates current and use modern cipher suites
  • Do not disable certificate verification in production clients

​
Authentication and Secrets

  • Use the authentication method agreed for the integration
  • Store credentials in an approved secrets manager
  • Scope credentials to the minimum required access
  • Rotate or revoke credentials after suspected exposure, personnel changes, or integration retirement
  • Never place production credentials in source control, examples, logs, or support tickets

​
API Security

  • Validate input and enforce authorization on the server
  • Use parameterized data access and safe output encoding
  • Apply appropriate request-size, rate, and abuse controls
  • Return structured errors without sensitive implementation details
  • Use idempotency controls for retryable write operations

​
Network and Availability Controls

Network restrictions, static egress addresses, private connectivity, DDoS controls, and provider-specific firewall requirements depend on the integration architecture. Document them during technical design rather than assuming they are available for every Avoca endpoint. See API and Integration Methods for contract-design guidance.