Client registration
Register the application/client, owner, environment, redirect/callback boundaries and accountable organisation.
INTEGRATION GUIDEREFERENCE CONTRACT
Integrate the trust context, not only the endpoint.
Move from client registration to governed production integration while preserving actor identity, organisation, mandate, thing context, state, authority and evidence.
REFERENCE CONNECTION MODEL
One request crosses several trust boundaries.
Transport success is never treated as legal authority or business acceptance.
01APPLICATIONUser or service client
→
02API GATEWAYRouting · quota · correlation
→
03IDENTITY / IAMClient · actor ·
organisation
→
04TRUSTED THINGIDPolicy · state · evidence
→
05CONNECTORRetry · reconcile · status
→
06EXTERNAL AUTHORITYAuthoritative domain
fact
GETTING STARTED
From client registration to an evidence-backed go-live.
Use the sequence below as the implementation checklist.
Choose environment
Keep Sandbox, Pilot and Production credentials, endpoints and evidence packages separate.
Authentication
Use the deployment-approved OAuth/OIDC profile and preserve client plus actor context where required.
Identity & mandate
Propagate who acts, for which organisation, under which role/mandate and with what assurance.
Choose API family
Resolver, DPP, Claims, Evidence, Mandate, Lifecycle, Search, Device Trust and Connectors carry different semantics.
State & evidence
For material writes, know the state before/after, policy version, idempotency key and evidence generated.
Events & webhooks
Verify callbacks, correlate events and design retries without inferring success from delivery alone.
Errors & recovery
Handle policy denial, invalid mandate, connector timeout, ambiguous external status and reconciliation explicitly.
Sandbox & conformance
Use synthetic data, negative cases and evidence-backed acceptance criteria before production.
Go-live gate
Pin API/schema versions, approved identity profile, connector compatibility, operational owners and rollback path.
REQUEST LIFECYCLE
Every material request needs a business envelope.
Use this envelope in design reviews and test evidence.
Actor & organisation
Who initiated the action and which organisation they represent.
Authority & mandate
Which role, mandate, purpose and assurance make the action eligible.
Thing context
Which official identifier, resolved thing and DPP/device context are affected.
Policy & state
Which policy version evaluates the request and what state transition is requested.
Evidence
Correlation, provenance, trusted time and evidence references produced by the action.
External authority
Which facts remain authoritative outside Trusted ThingID and how ambiguous status is reconciled.
ENGINEERING CONTROLS
Integration quality is operational quality.
Design for failure and repeatability before production.
Idempotency
Use an Idempotency-Key for material writes and define replay behaviour.
Correlation
Carry X-Correlation-ID through API, event, connector and evidence records.
Retry & reconcile
Separate transport retry from business reconciliation with external authorities.
Webhook verification
Verify source, signature/secret profile, event identity and duplicate delivery.
NEXT STEP
Read the HTML reference before downloading the contract.
The API Center explains business purpose, authorization, state, evidence and failure behaviour. Raw specifications remain available for tooling.