Overview

The Internal API is private for two reasons;

• first is that it is used to fetch information that might be seen as sensitive. And the services consuming the API are mostly using API-keys.
• second reason is that it requires a non NAT
  IP address from a visitor device. This IP is used to find the MAC-address in the access points.

The internal API supports with three different tasks

• verification and detection
• site search
• employee identification

This API is an API Gateway Private REST API. Some of the endpoints are public (in the private IP range), while others requires an API-key. The API-key is written in clear text in the web applications that are consuming the services. So the API-key should not be seen as a security mechanism, it is just preventing unnecessary usage of the API

.

Event Source

pal.visitors