Engineering Experience

IndoTium Developer Hub & API Conventions

Clear architectural principles, authentication patterns, signed webhooks, and retry-safe idempotency standards designed for reliable enterprise integration.

Webhooks Guide →Idempotency Guide →

Developer hub API code terminal showing REST request headers idempotency keys and JSON body

Platform Architecture

Core API Principles & Design Conventions

Engineered for predictability, auditability, and production reliability.

HTTPS Transport & JSON Payload

All API requests require TLS 1.3 encryption and use structured JSON body payloads.

Standard Content-Type: application/json; charset=utf-8. Protocol endpoints like SMPP or SIP follow their respective standards.

Explicit Authentication & Least Privilege

Bearer tokens and API keys must be passed in the Authorization header with scoped permissions.

Header format: Authorization: Bearer <api_token>. Never pass credentials in URL query parameters.

Request Traceability & Correlation IDs

Every HTTP response includes an X-Request-ID header for operational tracking.

Include X-Request-ID in developer support requests for rapid log correlation.

Idempotent Retryable State Mutations

Write operations support Idempotency-Key headers to ensure retry-safe processing.

Retrying a request with the same Idempotency-Key returns the identical result without duplicate execution.

Signed Webhook Event Notifications

Webhooks include HMAC-SHA256 signatures in headers for sender authenticity verification.

Header X-Indotium-Signature is generated using your webhook secret to prevent spoofing and replay attacks.

Consistent Error Envelope Structure

Errors return standard HTTP status codes accompanied by a structured JSON error payload.

Envelope includes code, message, request_id, and actionable troubleshooting guidance.

Illustrative Request Pattern

Standard HTTP Request & Auth Header

Every request requires HTTPS transport, explicit authentication headers, and an optional Idempotency-Key for write operations.

Fictional endpoint placeholder: https://api.example.invalid

Zero production credentials exposed in documentation

cURL / Illustrative Request

example.invalid

curl -X POST https://api.example.invalid/v1/messages \
  -H "Authorization: Bearer indotium_test_token_123" \
  -H "Idempotency-Key: 7b8c9d0e-1f2a-3b4c-5d6e-7f8a9b0c1d2e" \
  -H "Content-Type: application/json" \
  -d '{
    "channel": "whatsapp",
    "recipient": "+15550192834",
    "template_id": "auth_otp_v2"
  }'

Error Governance

Standard Error Codes & Envelopes

HTTP Status	Error Code	Description & Remediation
400	invalid_request_payload	The JSON request body failed schema validation or required fields are missing.
401	unauthorized_missing_token	Missing or malformed Authorization header.
403	forbidden_insufficient_scope	The provided API key or token lacks required scope permissions for this resource.
409	idempotency_conflict	A request with the same Idempotency-Key is currently being executed.
429	rate_limit_exceeded	Request volume exceeded the quota allocated to your environment tier.
500	internal_server_error	An internal platform error occurred; check X-Request-ID with technical support.

Need Developer Escalation or Integration Scoping?

Contact technical support at support@indotium.com or schedule an architecture discovery session.

Book a Discovery call Submit Integration Request