MOBILE-ID · TRUSTED LTANS
API security profiles
Choose Standard, Enhanced and internal connectivity; distinguish OAuth, mTLS and signed requests.
Choose a profile per connection boundary
These profiles define configuration decisions, not a claim that all environments are deployed. Confirm gateway, IAM and Core settings together.
| Profile | Client → Gateway | Gateway / adapter → Core | Condition |
|---|---|---|---|
| Standard | HTTPS + OAuth2 Client Credentials. | HTTPS; backend service identity and authorization. | No external mTLS unless the approved profile requires it. |
| Enhanced | OAuth2 combined with mTLS or client assertion under the profile. | Retain independently configured internal security. | Specify certificate issuance, rotation, trust and recovery when mTLS applies. |
| Internal / Core | Partners do not call Core directly. | mTLS/signed requests when required by Core. | Adapter cannot bypass Core policy for Standard clients. |
How OAuth and mTLS combine
The current OpenAPI retains operation-scoped OAuth2. MutualTLS is declared for enhanced profiles, not a global Standard requirement. In an Enhanced contract, two schemes in one Security Requirement Object mean AND; separate objects mean OR. Publish variants only after agreeing the profile.
{"security": [{"OAuth2": ["archives:write"], "MutualTLS": []}]}Distinguish four credentials
| Type | Purpose |
|---|---|
| OAuth access token | Application grants and API audience; not a signing certificate. |
| TLS client certificate | Authenticate the client side of an mTLS boundary. |
| Signing certificate | Validate a document/transaction signature. |
| TSA certificate | Validate a timestamp token. |