Skip to main content
API security is enforced through multiple layers: OAuth 2.0 and JWT-based authentication for secure, authorized access to all endpoints; all API communications exclusively over HTTPS with TLS 1.3 (no plain-text endpoints); API gateway-level rate limiting and connection throttling to prevent abuse and denial-of-service…
API security is enforced through multiple layers: OAuth 2.0 and JWT-based authentication for secure, authorized access to all endpoints; all API communications exclusively over HTTPS with TLS 1.3 (no plain-text endpoints); API gateway-level rate limiting and connection throttling to prevent abuse and denial-of-service patterns; input validation to prevent injection attacks; standard security headers in all API responses; and comprehensive logging of all API interactions for audit and compliance. Two-way mutual TLS authentication can be configured for specific high-security integration scenarios upon request. Learn more: Empuls Help Centre

Does the Empuls API enforce role-based access control?

Yes, Xoxoday Empuls enforces role-based access control at the API level, so each integration only accesses the data it is authorised to see…

What controls are in place on Xoxoday's end to prevent offboarded users...

Controls in place to prevent offboarded users from retaining access include: (1) SSO enforcement ensures that authentication is validated against the…