TABLE OF CONTENTS
Overview
Stack Internal APIs support sign-in, content ingestion, knowledge search, chat, and administration. Approved callers use product identity controls that associate each request with the appropriate user and organization. The APIs exchange the content, account details, and activity records needed to provide Stack Internal features.
Authenticated access
Stack Internal uses an identity provider for browser sign-in and programmatic access. After sign-in, the product issues a short-lived signed access credential for product services. Services validate that credential before handling protected requests and use the associated user, organization, and permission information for access decisions.
Organization separation
Stack Internal associates API requests with an organization and uses that information when it handles product data. Chat conversations and knowledge requests use the caller's organization context. This keeps product activity connected to the organization that authorized the request.
Controlled product actions
API functions support both retrieval and approved changes. Chat can return responses with related references, while content-ingestion functions accept submitted content for product use. Administration functions manage organization information through authenticated product requests.
FAQ
Data access, privacy, and storage
What customer data can API access or retrieve?
The API handles the content, account details, and activity records needed for Stack Internal features. Chat requests process the user's question, relevant knowledge, and conversation information. Content-ingestion functions receive submitted content and related source details. Each protected request is associated with the appropriate user and organization before it is processed.
Is customer data persisted, transmitted, or copied outside the approved environment?
Stack Internal stores chat conversations and content records in product-managed storage to support product features. When the chat function uses an AI provider to generate a response, it sends the question and relevant context needed for that request. The chat function does not send the user's product access credential to the AI provider.
How are tokens, credentials, or secrets stored, rotated, and revoked?
Stack Internal keeps service secrets and signing material in protected secret storage rather than application code. It issues short-lived signed access credentials after sign-in and validates them before granting protected API access. The default access-credential lifetime is five minutes, which limits the period in which an issued credential can be used.
Access and permissions
How does API authenticate users, services, or client applications?
Stack Internal uses its identity provider to authenticate browser users and programmatic callers. After successful sign-in, it issues a signed access credential for product services. Protected APIs validate the credential and use its user, organization, and permission information before processing the request.
Does API support enterprise single sign-on (SSO)?
Yes. Stack Internal supports enterprise single sign-on (SSO) through its identity provider. After a user signs in, Stack Internal creates a product access credential for use by its services. This allows product APIs to recognize the authenticated user and organization while keeping the external sign-in process separate from internal product requests.
What permissions does API need to access internal or external systems?
API access is limited to the product function being used and the caller's established permissions. Product services use the user, organization, and permission information in the signed access credential to make access decisions. Content-ingestion functions also require authenticated callers with valid organization identity details before handling protected content requests.
Security and audit controls
What monitoring and audit logging capabilities are available for API?
Stack Internal product APIs use health checks and structured operational logging to help operators identify service availability and processing issues. Product functions also record events used to coordinate related activity. These controls provide operational visibility for API-based features and support routine investigation of service issues.
How does API prevent unauthorized access, data exfiltration, or unauthorized write actions?
Stack Internal requires a validated signed access credential for protected API requests. Services associate requests with the authenticated user and organization before processing them, then apply the caller's permissions to the requested action. Product workloads also use restricted operating-system permissions, including non-root execution and a read-only root file system.
Integration and API usage
How is the connection established between API and internal or external systems?
Connected applications use authenticated requests to reach Stack Internal APIs. The chat function uses protected connections to related product functions for knowledge and organization information. Content-ingestion functions accept authenticated requests to receive and synchronize approved content from connected sources.
What API endpoints, resources, or data operations does API use?
Stack Internal provides APIs for chat, content ingestion, organization administration, reporting, and more. The chat API accepts requests to generate a response and can return related references. Content-ingestion APIs receive content and maintain the records needed to make it available to other Stack Internal features.
Does API support read operations, write operations, or both?
API functions support both reading and writing. Chat returns responses and can restore prior conversations. Content-ingestion functions accept and maintain submitted content, while administration functions retrieve and update organization information. Each action requires the appropriate authenticated product access.