DemoLog inContactDE
Integration Ledger

APIs as an active governance gatekeeper — not a passive data pipe.

A zero-trust middleware plane sits between every third-party API and your system of record. Tokens are verified, payloads are reconciled across identity, endpoint and contract state, and every approved transaction settles into a WORM ledger.

See the 3-layer modelBook a demo

Why most B2B APIs are a liability

Most platforms describe their API layer as a passive sync — webhooks fire, rows insert, no one looks again. That model leaks expired tokens, swallows replayed payloads and scatters the same event across uncoordinated tables. Lojycal treats every inbound API call as an untrusted instruction that must clear three gates before it touches the ledger.

The 3-layer integration architecture

[ UNTRUSTED THIRD-PARTY API ] ──> [ LOJYCAL MIDDLEWARE PLANE ] ──> [ SECURE SYSTEM OF RECORD ]
                                  - Zero-Trust Proxy Guard       - Cryptographic Verification
                                  - Token Expiry Intercept       - WORM Audit Ledger Push
Layer 1

Inbound Token Intercept

Every cron and webhook endpoint under /api/public/hooks/* enforces a server-side gate before any database row mutates. Cron callers must present a CRON_SECRET via x-cron-secret; webhook callers must present a HMAC signature verified with timing-safe compare. The browser-bundled anon / publishable key is never used as an authorization gate.

  • • Kandji webhook: HMAC-SHA256 verified, UNIQUE(org, event_id) dedupe, ±5-minute occurred_at skew window.
  • • Jira webhook: HMAC-signed Forge widget → /api/public/hooks/jira-impact.
  • • Replay protection: unique index on (provider, external_id) in idp_webhook_events.
Layer 2

Multi-table Cross-Reference Core

A single inbound event is reconciled across the entire ledger in one pass. The integration plane joins identity, endpoint, contract and procurement state behind the scenes — turning a fragmented webhook into a synchronised enterprise state machine.

  • • HRIS push runs read → confirm → write → verify against Personio / BambooHR before flipping employee_directory.source.
  • • Jira tickets are scored against global_pricing_benchmarks medians and persisted to jira_impact_assessments.
  • • Procurement intake reconciles CapEx and OpEx against procurement_policy (€1k / €5k / €25k tiers) and dual sign-off rules.
Layer 3

WORM Ledger Settlement

Approved API transactions, lifecycle adjustments and automated cost-containment events commit to write-once-read-many tables protected by the worm_block_mutation trigger. UPDATE and DELETE are blocked for everyone — including platform admins. Every write also emits an audit_log row via AFTER trigger.

  • • Vendor order dispatches → vendor_order_dispatches (WORM) + signed egress to the buyer's ERP.
  • • Incident reports → incident_archive + incident_reports (WORM).
  • • Evidence packs → signed with per-org keys in evidence_pack_signing_keys, every export logged to evidence_pack_signatures.

Secret hygiene at the privilege layer

Integration secrets are gated at the Postgres privilege layer, not just RLS. The browser-side role cannot read them — even with a valid session.

  • vendor_order_secrets — full table REVOKE from authenticated; access only via vendor_order_set_secret / vendor_order_get_secret RPCs.
  • kandji_org_secrets — service_role only; RLS enabled with no authenticated policies.
  • siem_egress_endpoints.hmac_secret / signing_secret_encrypted — REVOKE SELECT from authenticated and anon.
  • erp_oauth_tokens, erp_app_credentials.client_secret_enc — column-encrypted, never returned to the client.
  • org_agent_tokens.token / previous_token — never readable from the client; vended only through server-side RPC.
  • SIEM egress is HMAC-SHA256 signed per endpoint (X-Lojycal-Signature: sha256=…) — receivers verify the signature, not just TLS.

Reconciliation, not just sync

  • Inbound HRIS event → reconciled against employee_directory + enrolled_devices + license_subscriptions.
  • Inbound MDM event → routed via ingest_mdm_event (service_role) after org membership verification.
  • Inbound procurement ticket → priced against global_pricing_benchmarks before approval.
  • Inbound vendor PO → dispatched with exponential backoff (1m / 5m / 30m / 2h / 12h, max 5 attempts).
  • Inbound Jira webhook → scored green / orange / red against benchmark median, written to WORM.
  • Outbound SIEM egress → HMAC-signed per endpoint, every emission logged.

Governance on by default

  • Per-org RLS via is_org_member / has_org_role on every tenant table.
  • AAL2 required for privileged role mutations (admin / auditor / cfo) — password-only sessions cannot escalate.
  • Every role change written to audit_log via audit_user_roles_change AFTER trigger.
  • WORM tables: incident_archive, incident_reports, mdm_dispatch_failures, vendor_order_dispatches, jira_impact_assessments, evidence_pack_signatures.
  • Webhook secret-scan trigger on idp_connections rejects writes containing AWS / GitHub / Slack / Stripe / OpenAI / JWT patterns.
  • Evidence packs signed with per-org HMAC keys — receivers verify the signature, the export is non-repudiable.

One integration plane. One signed ledger.

Stop treating APIs as a transport layer. Treat them as the front door to your audited system of record — gated, reconciled and immutable by default.

Book a demoData RetentionSee pricingSee SSPM vs CSPM