This directory contains additional documentation for the Credence Backend.
- API & Endpoint Deprecation Policy – endpoint deprecation support windows, communication cadence, and client migration guidelines.
- API Stability & Versioning Discipline – versioning discipline, breaking change definitions, and SemVer rules.
- Blameless Postmortem Template – template for incident reviews with timeline, impact, root cause analysis, and action items.
- Replay & Inspection Guide (Operator) – when to replay failed events and how to inspect prior failures.
- Tenant Cache Invalidation (Support CLI) – clearing a tenant's cached data without restarting the service.
- Replay‑Safe Handlers & Side‑Effects – ensuring side‑effects are safe during retries.
- Idempotency Guard – replay protection for HTTP requests.
- API Key Scopes – every available scope, which endpoints each unlocks, legacy tier aliases, and how to request the right set for your integration.
- Incoming Webhook Security & Posture – HMAC-SHA256 signature verification, 5-minute replay window, and CIDR allowed origins.
- Event Ordering Guarantees – ordering guarantees and guidelines for downstream consumers.
- Environment Deployment Guide – step-by-step deployment instructions for development, staging, and production environments.
- Caching Layer – Redis caching architecture,
CacheServiceAPI reference, and stampede protection. - Cache Invalidation Strategy – invalidation patterns and read-after-write consistency across replicas.
- Cache Inventory – every cache namespace in the codebase and its TTL, in one table.
- Grafana Metrics & Dashboards Reference – detailed mapping of Grafana dashboard panels to Service Level Indicators (SLIs) and Objectives (SLOs) for operators.
- Rate Limiting Design – tenant/IP/key rate-limiting windows and tiers.
- HTTP Status Reference – every HTTP status the API returns, when to use each one, and how to throw the right error from a route handler (contributor-facing).
- Input Validation Guide – how we validate request inputs (path params, query, body) and surface errors.
- Key Rotation Procedure – JWT signing key rotation cadence, grace window, and verification checks.
- Integration API Key Lifecycle – complete lifecycle for integration API keys: create, list, rotate, revoke, with audit trail and authorization model.