API publication and support policy

An API can be published only when all of the following are recorded and approved:

1. Classification: public, authenticated customer, or private/internal.
2. Owner: accountable product and engineering owners.
3. Support commitment: availability, response, compatibility, and support channel.
4. Contract: versioned request/response schema, errors, idempotency, pagination, and limits.
5. Authentication and authorization: supported client identity and least privilege.
6. Tenant isolation: every operation enforces the caller’s authorized dealer_id; identifiers alone are not authorization.
7. Abuse controls: rate limits, quotas, validation, monitoring, and safe failure behavior.
8. Data review: sensitive fields, retention, consent, audit, and redaction.
9. Operational readiness: observability, incident owner, rollback, and dependency behavior.
10. Lifecycle: changelog, deprecation window, migration guidance, and retirement process.
11. Examples: synthetic values only—no secrets or real customer data.
12. Specification: only approved operations appear in the published OpenAPI document.

Supabase Edge Functions and private service routes remain internal unless individually promoted through this process.

Owner: EntryBook API GovernanceLast reviewed: 2026-08-21Applies to: Web and mobileVersion: EntryBook 1.x

Was this page helpful?Yes·Needs improvement