Security

All API communications should use TLS encryption (HTTPS):

• Prisme.ai API endpoints only accept HTTPS connections
• Self-hosted instances should be configured with valid TLS certificates
• Minimum TLS version 1.2 is recommended
• Client applications should validate server certificates

Prisme.ai uses a secure microservices architecture:

• The api-gateway is the only publicly exposed service
• Backend microservices are in a private network
• Internal services trust the x-prismeai-user-id header from the api-gateway
• Service-to-service communication uses internal authentication

For self-hosted deployments, consider implementing IP restrictions:

• Limit API access to specific IP ranges
• Use VPNs or private networks for sensitive operations
• Configure firewalls to restrict access to the api-gateway
• Implement network policies in Kubernetes deployments

# Example Kubernetes Network Policy
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: api-gateway-policy
  namespace: prisme-system
spec:
  podSelector:
    matchLabels:
      app: api-gateway
  ingress:
  - from:
    - ipBlock:
        cidr: 10.0.0.0/24
    ports:
    - protocol: TCP
      port: 443

Handle authentication tokens securely:

• Store tokens in secure HTTP-only cookies or secure storage
• Never expose tokens in URLs or client-side code
• Implement token refresh mechanisms
• Set appropriate token expiration times
• Revoke tokens when no longer needed

Follow the principle of least privilege:

• Use API keys with minimal required permissions
• Create role-specific tokens for different operations
• Regularly audit and revoke unused access
• Use workspace-scoped tokens instead of global ones

// Example of creating a minimally privileged API key
const response = await fetch('https://api.studio.prisme.ai/v2/workspaces/ws-123/apiKeys', {
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Authorization': `Bearer ${userToken}`
  },
  body: JSON.stringify({
    name: 'Read-only Document Access',
    permissions: [
      {type: 'workspace', id: 'ws-123', action: 'read'},
      {type: 'document', id: '*', action: 'read'}
    ],
    expiresIn: 7 * 24 * 60 * 60 // 7 days
  })
});

Always validate input data:

• Validate data types and formats
• Sanitize inputs to prevent injection attacks
• Use schema validation for request bodies
• Implement proper error handling for invalid inputs

// Example of input validation
function validateWorkspaceId(workspaceId) {
  // Check for correct format (example: ws-123456)
  if (!/^ws-[a-zA-Z0-9]{6,}$/.test(workspaceId)) {
    throw new Error('Invalid workspace ID format');
  }
  return workspaceId;
}

When developing automations and integrations:

• Avoid storing sensitive data in automation code
• Use workspace secrets for credentials and tokens
• Implement proper error handling and logging
• Validate outputs from untrusted sources
• Limit HTTP request capabilities to necessary endpoints

# Example of using workspace secrets in automation
do:
  - fetch:
      method: POST
      url: ${secrets.API_ENDPOINT}
      headers:
        Authorization: Bearer ${secrets.API_TOKEN}
      body:
        data: ${input.data}

Implement a regular security review process:

• Audit API keys and access tokens
• Review user permissions and roles
• Check for unused integrations
• Monitor for suspicious activity
• Update client libraries and dependencies

Implement monitoring for security events:

• Authentication failures and successes
• Permission changes
• API key creation and usage
• Rate limit violations
• Unusual access patterns

For self-hosted deployments, integrate with your SIEM system for centralized monitoring.

Configure comprehensive logging:

# Example logging configuration
- emit:
   event: 
   payload: 
     level: info
     securityEvents: true
     accessLogs: true
     authenticationEvents: true
     format: json
     outputs:
       - type: stdout
       - type: elasticsearch
         config:
           url: https://elasticsearch:9200
           index: prisme-logs

Prepare for security incidents:

• Document incident response procedures
• Define roles and responsibilities
• Test response plans periodically
• Establish communication channels
• Implement post-incident reviews