Identity and permissions
Every protected API operation requires a bearer token. Matcher refuses a caller that lacks the permission that the operation needs.
401. For the permission that each operation needs, see the Matcher API reference.
Tenant isolation
Matcher takes your tenant from the
tenant_id or tenantId claim of your token.
Audit records
Matcher records configuration changes and exception resolutions as audit records for your tenant. The records are append-only and linked in a SHA-256 hash chain. You can re-check the chain. A check inspects up to 10,000 records, by default from the lowest stored sequence, and never changes a record. To start the check at a later sequence, use the
fromSeq parameter. When the first record the check reads is not sequence 1, the check trusts that record’s stored link. It does not verify the records before it. For the audit and archive endpoints, see Governance.
Personal data
Matcher encrypts the display name and email of an actor mapping before it stores them. Audit records keep the raw actor identifier from the original request, which can be an email address. For details, see Actor mappings.
Credentials and inbound calls
- Matcher stores only the SHA-256 hash of an exception-callback token or an aggregator webhook token. It shows the raw token once, when it creates it.
- An exception callback must carry a valid callback token for your tenant.
- Matcher accepts an aggregator webhook only on a URL that carries a valid token for your tenant, and only after it verifies the source by HMAC signature or by IP address. A webhook that fails the source check answers
401.
Next steps
Governance
Manage actor mappings, audit logs, and archives.