Utilising the sandbox environment for API development requires the First AML team to configure your account. When you are ready to begin testing your integration, reach out to First AML support with the following details:
- Emails of users to be provisioned as users within the sandbox environment and roles for those users (these will be used for manual testing).
Once your account is set up, you can create the API credentials your integration needs yourself.
Creating your API credentials
API credentials are managed by your own team from within the First AML Platform, under Settings > Integrations > API Credentials. From this page you can:
- Create an API client, selecting the scopes it requires (include the
api-managementscope if you wish to manage webhooks via the API). - View the
Client IDandClient Secretof your existing API clients. - Delete an API client that is no longer required.
When creating an API client you will be asked “What external system are you connecting to?”. Select Other.
You will need to create API credentials separately in each environment you intend to use, as credentials are not shared between Sandbox and Production. The Platform URL for each environment is listed on the Environments page.
Once your API client is provisioned with the api-management scope, you can manage your webhook subscriptions directly through the API. See the Webhooks documentation for details.
Before going live
Once you have completed the development of your integration and tested it against the Sandbox environment, you can deploy it to the Production environment.
Before you do, we ask that you review your integration against the checklist below. These are the behaviours we expect of every integration against the Public API, and working through them in Sandbox before you go live will help you avoid problems in Production.
Making requests
- The integration respects rate limits, and applies concepts like exponential back-off before re-attempting requests.
- Access tokens are cached appropriately, and the integration does not continue to request new access tokens while the last one has yet to expire.
- All requests include a
User-Agentheader (requests without one will be blocked with a403 Forbiddenresponse). - The integration does not attempt to access resources it is not authorised to (based on the scopes selected).
- The integration is not over-selecting data beyond what your specific use case requires.
Protecting your credentials
- API credentials are not stored in plain-text configuration files.
- API credentials are not checked into source code.
- API credentials are stored encrypted at rest.
- Access tokens are stored encrypted at rest (unless cached in-memory only).
- API credentials and access tokens are only stored and utilised server-side, and are not exposed to any client-side technology which would allow an end-user of the integration to gain the access token for the purposes of making their own requests.
The data held within First AML is incredibly sensitive and we take the security of our customers and end users data very seriously, please make sure you follow these recommendations to keep your sensitive data safe.
