Security
What is protected, and what is deliberately absent.
This page is written for a security review, so it names the limits as plainly as the protections.
The tenant never comes from the request.
There is no field, no header and no path segment by which a request states which company it applies to. The company is on the key and is fixed when the key is issued; every query behind it is bounded by that, and another company's record answers as though it did not exist.
Prepare, yes. Trigger, no.
What can be written here is recoverable: a customer, a job, a draft. Anything that spends a number, moves money or hands a document to an authority has no address here and no scope through which it could get one.
What the one in the path promises.
Within one version fields may be added; a field does not disappear, does not change type, and an error code does not change meaning. So read tolerantly: an unknown field is not a fault but a later release.
If a key gets away.
Revoke it on the developer screen; it stops working at once. Rotating keeps the relationship, so an audit can follow one integration across its key changes. KRONENWERK cannot show you a key twice — only its hash is stored.