Skip to content
DEV preview — API version 1.0.0 — not the public production site — Development API: dev-api.theprioryshop.co.uk
EPOS Developer API

Security & Data Handling

Access boundaries

Section titled “Access boundaries”

Every request is authenticated by an Integration API key, and every response is filtered to exactly what that key’s tenant, scopes, and (if set) store restriction allow. There is no way to see another tenant’s data through this API, regardless of what you ask for - tenant identity comes entirely from the key, never from a request parameter.

What’s never returned, on any route

Section titled “What’s never returned, on any route”

Regardless of scope: cost prices, margins, supplier pricing and mappings, stock movement/adjustment history, purchase/invoice history, staff identities, internal audit metadata, and the internal promotion rule-engine configuration (raw targeting/stacking/priority data). Each resource’s page under API states exactly what’s excluded for that resource specifically.

How credentials are stored

Section titled “How credentials are stored”

EPOS stores Integration API key secrets as a one-way hash, not as retrievable plaintext - the same general principle as password storage. A full secret is shown to you exactly once, at creation or rotation time; EPOS itself cannot show it to you again afterward. See API Keys.

Your responsibilities as an integrator

Section titled “Your responsibilities as an integrator”
  • Follow Security: store keys server-side only, never in a browser, never in source control.
  • Rotate a key immediately if it may have been exposed.
  • Request only the scopes and store access your integration actually needs.
  • Handle errors explicitly rather than assuming success, especially 401/403 (which usually mean a real configuration or access change, not a transient blip - see Key Revocation).
  • Respect rate limits - back off on 429 rather than retrying immediately.
  • If you store data fetched from this API (a local copy for a sync integration), apply your own appropriate data protection to it - this API’s access controls don’t extend into your systems once data leaves EPOS.

Reporting a security concern

Section titled “Reporting a security concern”

If you believe you’ve found a security issue with this API (not a bug in your own integration), report it through the same channel you were given your Integration API key - don’t post details publicly before it’s addressed.