In order to promote your integration to our production environment, we will require the following to be in place:
- Completed Application Review
- Signed Partner Agreement
- Completed Cyber Questionnaire and security assessment
We will need you to provide the following information to us and walk us through your application and its integration with Class. The following considerations need to be addressed:
Provide us with a demo of your application, showcasing the end-to-end integration. Contact us at partners@class.com.au to arrange a meeting and provide us with a demo.
Please provide us with an integration diagram.
Partner to confirm/provide the following:
- All interactions/redirects are made over https.
- Application uses the state parameter on authorization requests to mitigate CSRF attacks.
- Application requests an appropriate (i.e. minimal) set of permissions via the scope parameter in authorization requests.
- Application utilises refresh tokens where appropriate instead of requiring Class users to click through the authorization process multiple times.
- Partner to provide Class with list of IP addresses from which the requests will originate.
Partner to provide the following:
- The Class API endpoints that the partner application will be connecting to.
- How many Clients do you expect will be connecting to the APIs.
- The total number of expected requests per day, type of request initiation (user triggered, scheduled or batch), time and volume throughout the day.
Partner to ensure that Client doesn't request data in ways that are likely to place undue load/stress on Class servers. Please refer to our rate limiting documentation: Rate Limiting.
Please provide the following:
- Confirmation that the partner application will not exceed 500 API requests per minute.
- Details of the back-off handling (if the rate limit is triggered) for HTTP 429 response.
- If calls are automated, how are they scheduled/queued to ensure that we don’t see large spikes in API request volumes.
Partner to provide the following:
- Confirmation that application handles errors from the Class API gracefully (including when a Class user cancels the authorization process).
- Details of error handling and retry process - if requests are batched and an error occurred, will a retry initiate a single request to be made again or will the entire process be restarted.
Please refer to the following document: Managing Access and Refresh Tokens.
Partner to provide details of token management strategy and how the app will address the following:
- Access Token Storage: How and where are the access tokens stored (e.g., in-memory, local storage, etc.)
- Refresh Token Handling: If your app uses refresh tokens, how are they stored and managed? Please describe the process for using a refresh token to obtain a new access token.
- Token Security: What measures are in place to prevent tokens from being exposed or compromised?
- Re-Authorisation: If a refresh token is revoked/expires, how will the client re-authorise the app?
Contact our Partnership Manager to complete.
You will need to complete an assessment/questionnaire to ensure that your integration complies with our standards. Our Partnership manager will facilitate this step to satisfy the group IT Security and Cyber review signoff.
- Partner Information: Detailed information of the Partner, application/product, data centre locations, third parties involved, penetration test frequency, etc.
- Partner Certifications: Which certification do you currently possess verifiable certification or independent audit report. I.e. ISO27001, SSAE16 SOC-1 SOC-2 or SOC-3, PCI-DSS or if you currently a DSP with ATO, to ensure that your integration is compliant.
- Partner Questionnaires: Details about your Application key management, encryption in transit and encryption at rest. MFA, indirect access to data, vulnerability management, audit logging. Additional information about hosting onshore, security monitoring, backups and incident management.
After the security questionnaire is completed, the Class compliance & Cyber security teams will review the assessment. Upon successful review, Class will approve your keys to access production. Note: The Production environment uses different OAuth keys and server URL than the PIE environment.
Partners are subject to annual audit of these controls as per the Partner Agreement.