English 
Tiếng ViệtAPI SECURITY
Authentication, authorization and request trust
Every operation states the client identity, user context, scope, tenant/RP binding and transport/request protection that it requires.
01
Authentication paths
| Path | Use | Controls |
|---|---|---|
| OAuth2 client credentials | Service-to-service | Client ID, scope, audience and rotation |
| OIDC user context | User-delegated flows | Subject, authentication context and consent |
| mTLS | High-assurance service identity | Certificate chain, SAN and revocation |
| Signed request | Selected channels | Timestamp, nonce, body digest and key ID |
| WebAuthn assertion | Signer approval | Challenge, origin, RP ID, credential and counters |
02
Scope model
| Scope | Purpose |
|---|---|
| signing.request | Create/read signing requests |
| signing.approve | Submit/verify signer approval |
| signing.activate | Issue or consume signature activation |
| signing.execute | Execute approved signature operations |
| evidence.read | Read evidence and verification results |
| evidence.renew | Request evidence renewal |
| admin.providers | Manage approved CA/provider routes |
03
Secret-handling rules
- No access tokens in URLs or logs.
- Credential IDs and signer identifiers masked outside the trust boundary.
- SAD values short-lived, purpose-bound and never returned to unauthorized clients.
- mTLS private keys stored in approved key protection.
- Webhook secrets rotated and versioned.