Security

How access works, what an ID is and isn’t, and how to report a vulnerability.

How access works

Three things must all hold before your PMS sees a property:

1. PMS credential. The key is valid, current and belongs to the environment you call.
2. Scope. The key carries the scope the route needs: properties:read to list and read properties.
3. Connection. The property’s host has connected that property to your PMS. A scope never grants a property by itself.

If any of the three fails, you get 401, 403 or 404 respectively. A property you may not see answers exactly as one that does not exist.

A property ID is not a credential

A property id is an identifier. Knowing it grants nothing: only the three conditions above do. You can store and log IDs freely, but treat your PMS credential as a secret (see Authentication).

Data minimisation

The API shares only what a PMS needs to map a property. See Data ownership for what is never shared.

Reporting a vulnerability

If you find a security issue in the Tatallo PMS API or this site, email [e-mail] with Security in the subject. Please don’t disclose it publicly, and don’t access data that isn’t yours while investigating. Include what you found, how to reproduce it, and any request IDs. Tatallo confirms receipt and keeps you informed until it is fixed.

If you believe one of your keys leaked, say so in the first line: Tatallo revokes it at once and issues you a new one.