REST API

Connecting a system you already run — directly, or through a connector.

Anything that can make an HTTP request can issue credentials. Beyond the API itself, there are two ways to keep Nomi in step with a system without writing a synchroniser.

Connectors

A connector is anything that puts people into the platform: a CSV upload, an SFTP drop, a scheduled pull against a source system, or SCIM provisioning from an identity provider. They all converge on one operation — upsert a subject — which is why a spreadsheet and an identity provider produce the same result.

• POST /v1/connectors — create one; PATCH and DELETE to maintain it.
• POST /v1/connectors/{id}/upload — hand it a file.
• POST /v1/connectors/{id}/sync — run it now.
• POST /v1/connectors/preview — see what a file would do before it does it.
• GET /v1/connectors/{id}/runs — what each run did.
• /scim/v2/Users and /scim/v2/Groups — SCIM 2.0, for an identity provider to push people directly.

Policies

A policy is declarative issuance: subjects matching a rule hold a credential. It is evaluated on a schedule, with a blast-radius limit — a rule whose data collapses raises an alert instead of revoking a company.

• POST /v1/policies — define one.
• POST /v1/policies/{id}/preview — who it would affect, before it affects them.
• POST /v1/policies/{id}/apply — run it.

The shape of an integration

1. 1

   Upsert on change

   When your record changes, PUT /v1/subjects. Idempotent, so a full re-sync is safe.

2. 2

   Issue once

   POST /v1/credentials with an Idempotency-Key derived from something stable on your side.

3. 3

   Listen

   Subscribe to credential.* so your system knows when a pass was installed, failed or was removed.

4. 4

   End deliberately

   Revoke or suspend from the same event that ends the relationship in your system.