> For the complete documentation index, see [llms.txt](https://synap.ac/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://synap.ac/docs/api/security-and-rate-limiting.md). # Security & Rate Limiting ### Encryption All requests to the Synap API must be made over HTTPS. Any attempt to access the API over HTTP will be rejected. This ensures that data in transit is encrypted and protected from man-in-the-middle attacks. In addition to HTTPS for data in transit, all data stored by Synap is encrypted at rest. We adhere to industry-standard encryption practices to safeguard your information. ### Authentication The vast majority of endpoints within the the Synap API require authorisation. Authorisation is handled through Personal Access Tokens (PATs). A missing, invalid or revoked PAT will result in a `401 Unauthorized` error. The Synap API has a select few endpoints that enable "public" access without authorisation. These facilitate loading of public information such as portal branding. These "public" endpoints are subject to stricter rate-limits and maybe subject to "captcha" challenges. There are currently no particular use-cases for using these endpoints when building integrations. This means that we do not expect you, as a third-party developer to make use of the public endpoints, although we cannot strictly-speaking restrict your access outside of rate-limits, CORS or captchas. ### Token Security PATs are long-lived and do not expire automatically. Treat these tokens as sensitive credentials; they should be stored securely and never hard-coded into client-side code or version control systems. If a PAT is suspected to be compromised, it can be revoked immediately via the Synap platform. ### Permission Management Access to API resources is governed by a flexible permission system built into the Synap platform. Permissions are customized by your organisation on a per-group basis, and users are granted privileges based on their group memberships. Actions are constrained by the policies defined by your organisation. These privileges are upheld by the use of PATs and Subject-User headers in requests. ### Rate Limiting To protect against abuse and ensure fair usage, the Synap API enforces rate limits on incoming requests. Exceeding the rate limit will result in temporary throttling or rejection of requests. ### Request Logging Synap maintains logs of API requests for a predefined period. These logs are useful for auditing, troubleshooting, and identifying potential issues within your integration. Our engineers do from time-to-time review these logs as part of support requests, or proactively when problems are suspected with the API. Please note that sensitive data, such as your PAT and PIDs are automatically scrubbed prior to being dispatch to our observability systems. ### Security Monitoring Synap actively monitors API usage for suspicious activity. While we take measures to detect and mitigate potential threats, it is your organisation's responsibility to enforce best practices in API usage, token management and correctly bounding your privileged resources to appropriate users. ### Critical Security Patches To protect your resources, Synap may introduce critical security patches to the API even if they are considered breaking changes. While we aim to minimize disruption, the security of your data and operations is our top priority. In any such event you will receive communications from Synap detailing the cause, concerns and remediations, facilitating your organisation with the change where needed. ### Cross-Origin Resource Sharing The Synap API is designed for programmatic extension and use-case customisation. It is strictly prohibited that you use this API to build a competing User Interface experience using this API. Response headers from the Synap API will not include the necessary [CORS Headers](https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS) to enable such integrations, and likely result in an error on most modern-browsers. If your organisation has a legitimate use-case that you believe should exempt your integration from this restriction, please get in touch with your account manager so that we can have a discussion. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://synap.ac/docs/api/security-and-rate-limiting.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.