Reference Overview

A map of the technical reference: which section answers which question, and an order to read the pages in for a security review or for an API integration.

Reading Order For A Security Review

The questions a reviewer usually asks, in the order they usually come up, each with the page that answers it. Each link opens the page at the section named after the colon, with the page’s technical part already open.

1. Where does the data live, and how is each kind protected? Data Isolation: Storage And Protection By Data Type
2. Who outside your company can reach it? Data Isolation: What Zonitix Can Reach On Your Server
3. How is the system laid out, and where are the trust boundaries? Design Philosophy: Request Routing Through The Gateway
4. How are requests carried? Transport & Service Trust: Request Path And TLS
5. How are passwords and tokens stored? Transport & Service Trust: How Passwords And Tokens Are Stored
6. Which outside systems does the server connect to? Transport & Service Trust: Outbound Connections
7. What software does the server run, and at which versions? Transport & Service Trust: Components And Versions
8. Is any part shared between customers? Design Philosophy: The Shared Apple MDM Service
9. Which roles exist, and how are permissions decided? Roles & Permissions (RBAC): Built-In Roles
10. How is access requested, approved and reviewed? How Access Reviews & Access Requests Work: Access Reviews
11. When is a second factor required, and how is it enrolled and checked? MFA Enforcement: The MFA Endpoint Map
12. How does single sign-on work, and how is it verified? SSO, Passwordless Login & SCIM: Federated, Not Self-Hosted
13. What is recorded, and where can it be sent? Audit Log & Log Forwarding: Reading The Log
14. How are backups taken, restored and tested? Backup, Restore & Updates: Two Permissions, Not One
15. What is kept in escrow for recovery? Key Escrow & Recovery: What The Server Keeps
16. What happens when a part is down? Failure Modes: What Happens When A Part Is Down
17. Which limits and lifetimes are fixed? Rate, Size & Time Limits
18. How are export and erasure requests handled? GDPR Compliance: How A Data Request And An Erasure Run
19. What is stored, table by table? Data Model & ERD

Reading Order For An API Integration

For a developer writing code against an instance. To create the token itself, follow the guide Create an API token.

1. How do I authenticate a request? API Authentication
2. Which endpoints exist, and what do they take and return? API Reference
3. What does an error look like, and what is safe to retry? Error Handling
4. Which rate, size and time limits apply? Rate, Size & Time Limits
5. What does each status code usually mean? API Error Troubleshooting
6. Which calls does an instance accept from outside? Webhooks (Inbound & Signed Outbound)
7. How do the records relate to each other? Data Model & ERD
8. What has changed? Changelog

What Each Reference Section Answers

Every reference page, grouped as in the sidebar.