Authentication
Internal administrative access currently uses a server-validated administrator token. Enterprise OAuth client credentials and customer-issued scopes are a target contract, not a generally available public credential flow.
DEVELOPER PLATFORM
Extend the platform without bypassing its controls.
CORIIO APIs and connector contracts carry organization scope, permission, evidence and audit semantics. This page distinguishes implemented interfaces from planned SDK packaging.
PUBLIC API
Versioned metadata is available now.
The implemented public surface begins at /api/public/v1. The metadata endpoint exposes the API version and supported contract boundary. Broader domain APIs remain internal until authorization, pagination and lifecycle behavior are stable enough to publish.
GET /api/public/v1/meta
Accept: application/json
{
"name": "CORIIO Public API",
"version": "v1"
}Organization scope
Every domain request must resolve one organization before reading or changing state. A client token never converts a cross-organization request into an authorized one.
Pagination and idempotency
List contracts use bounded pages and stable cursors. Mutation and webhook consumers use idempotency identifiers so retries do not create duplicate work.
Errors and correlation
Errors distinguish invalid requests, missing authority, policy refusal, conflicts, throttling and dependency failure. Correlation identifiers connect client errors to server audit evidence.
WEBHOOK CONTRACT
Verify, deduplicate, then acknowledge.
The webhook model uses signed requests, timestamp tolerance, event identifiers and bounded retry. Consumers store the event identifier before executing side effects and return success only after durable acceptance.
- Signature verification before JSON processing
- Replay-window enforcement
- Idempotent event handling
- Exponential retry with terminal dead-letter visibility
POST /webhooks/coriio
X-Coriio-Event: evt_01...
X-Coriio-Timestamp: 1786579200
X-Coriio-Signature: v1=...
{
"type": "workflow.completed",
"organizationId": "org_..."
}SDK availability
The connector SDK and certification harness are implemented inside the CORIIO platform repository. Standalone TypeScript, Python, Java and .NET client packages are not presented as available until versioned packages and published support contracts exist.
Build a connector
A connector package defines authentication, discovery, extraction, normalization, checkpoints, deletion behavior, permission mapping, health and certification cases.
Read connector documentation →