From contract to production-grade integration.

Quickstart

The evaluation environment provides permission-scoped one-click identities. Production clients use federated human identity or OAuth 2.0 workload identity with mTLS. All resources are evaluated against organization, workspace and role context.

curl https://nabardapi.mapplsgov.com/api/health

{
  "status": "ok",
  "service": "Mappls Integration Fabric",
  "edition": "Enterprise Sovereign",
  "customerWorkspace": "NABARD Enterprise",
  "availabilityTarget": "99.999%",
  "release": "2026.3"
}

Identity, tenancy and authorization

Every session carries a home workspace and permission set. Platform administrators may enter a customer workspace only through a reasoned, time-bound, prominently indicated support session. Sensitive mutations require the matching permission and CSRF protection for browser sessions.

Required mutation headers

Authorization: Bearer <access-token>
X-Workspace-Id: rural-credit
X-Correlation-Id: CASE-2026-00042
Idempotency-Key: CASE-2026-00042-create
Content-Type: application/json

API product lifecycle

An API product joins a versioned contract, documentation, runtime policy, plans, subscriptions, applications, SLOs and ownership. Publication and promotion are separate decisions.

Create a draft product

curl -X POST https://nabardapi.mapplsgov.com/api/catalog/apis \
  -H "Authorization: Bearer $TOKEN" \
  -H "Idempotency-Key: product-customer-eligibility-v1" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Customer Eligibility",
    "version": "0.1.0",
    "protocol": "REST",
    "visibility": "partner",
    "auth": "OAuth2 + mTLS",
    "owner": "Credit Products"
  }'

Consumer onboarding

1. Register an applicationCreate a workload identity for a named environment and owner.
2. Choose a planCompare quota, rate, scope, SLO and approval policy.
3. Request accessSupply intended use, data purpose and callback/network information.
4. Receive credentialsAfter maker-checker approval, retrieve only the credential fingerprint and expiry in the portal.
5. Rotate safelyUse overlap windows and audit evidence to move without downtime.

Integration assets

Adapters, maps and mediation routes are reusable, versioned assets—not private code inside one application. The platform distinguishes transport, transformation, orchestration and message durability.

Durable workflow orchestration

A workflow run persists input, cursor, correlation, event history and committed side effects. Approval and callback steps release compute while state remains durable. Authorized operators resume the exact run.

Start an idempotent run

const response = await fetch(
  "/api/orchestrations/flow-kcc-decision/run",
  {
    method: "POST",
    headers: {
      "Authorization": `Bearer ${token}`,
      "Content-Type": "application/json",
      "Idempotency-Key": "CASE-KCC-2026-00042"
    },
    body: JSON.stringify({
      correlationId: "KCC-2026-00042",
      payload: { district: "Nashik", applicantRef: "masked-942" }
    })
  }
);
const run = await response.json();

Queues, topics and governed replay

The event mesh provides persistence, partitioning, ordering policy, back-pressure, TTL, retention, transactions, dead-letter handling and poison-message quarantine. Replay is a privileged recovery action requiring a reason and audit record.

curl -X POST \
  https://nabardapi.mapplsgov.com/api/messaging/msg-partner-callback/replay \
  -H "Authorization: Bearer $SUPPORT_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{ "limit": 25, "reason": "INC-2408 recovery validation" }'

Environment promotion

Build once and promote the same signed artifact through Development, SIT, UAT, Production DC and Production DR. Quality evidence and rollback readiness travel with the release.

Observability and service operations

Every request or event receives a correlation identifier that connects gateway policy, workflow steps, broker delivery, backend calls, access decisions, deployment changes and incidents.

Metrics, logs and traces are exportable through open telemetry patterns. Security and privileged events forward to the customer SIEM/SOC; incidents and changes integrate with customer ITSM.

Errors, correlation and safe retry

Errors use a stable machine code, human message, correlation ID, retryability and details. Clients must never retry blindly.

{
  "error": {
    "code": "WORKFLOW_NOT_WAITING",
    "message": "Run is not waiting for approval",
    "correlationId": "KCC-2026-00042",
    "retryable": false
  }
}

Control API reference

Download the complete machine-readable OpenAPI 3.1 specification.