Identity and permissions
Tenant isolation
With authentication enabled, Matcher reads
tenant_id or tenantId from the token. If tenant claims are optional and absent, it uses the configured default tenant. With AUTH_ENABLED=false, it uses that default tenant without reading a token.
Audit records
Matcher records configuration changes and exception resolutions as audit records for your tenant. The records are append-only and linked in a SHA-256 hash chain. You can re-check the chain. A check inspects up to 10,000 records, by default from the lowest stored sequence, and never changes a record. To start the check at a later sequence, use the
fromSeq parameter. When the first record the check reads is not sequence 1, the check trusts that record’s stored link. It does not verify the records before it. For the audit and archive endpoints, see Governance.
Personal data
Matcher encrypts the display name and email of an actor mapping before it stores them. Audit records keep the raw actor identifier from the original request, which can be an email address. For details, see Actor mappings.
Credentials and inbound calls
- Matcher stores only the SHA-256 hash of an exception-callback token or an aggregator webhook token. It shows the raw token once, when it creates it.
- An exception callback must carry a valid callback token for your tenant.
- Matcher accepts an aggregator webhook only on a URL that carries a valid token for your tenant, and only after it verifies the source by HMAC signature or by IP address. A webhook that fails the source check answers
401.
Next steps
Governance
Manage actor mappings, audit logs, and archives.