Security, Identity & Compliance

Identity, fine-grained authz, secret custody, detection & response, and compliance evidence.

The trust plane: OIDC identity and multi-tenant users, relationship-based authorization with replayable decisions, a Vault secret and Transit-signing engine, a SecOps detection-and-response platform, GRC controls and findings, plus KYC and privacy (consent, DSAR, erasure). Governance is structural — every service inherits it, none re-implements it.

Auth is one model across every service here — an SS-01 bearer token plus X-Tenant-Id on every /api/v1 route. Public base https://api.nexocloud.io/api/v1.

7 real backends, 143 operations.

Every path below is a real route from services/<svc>/openapi.json. Each service lists a representative slice of its full contract.

Identity SS-01

17 operations

OIDC identity — tenants, users, sessions, token mint/refresh/revoke and introspection.

POST/api/v1/auth/tokenMint access + refresh tokens (password or client_credentials).
POST/api/v1/auth/introspectIntrospect a bearer token.
POST/api/v1/tenantsBootstrap a tenant.
POST/api/v1/usersCreate a user in a tenant.
POST/api/v1/sessions/end-othersEnd all other sessions for the caller.

Vault SS-05

14 operations

Secret custody & signing — KV secrets, dynamic creds with leases, and a Transit sign/verify/rotate engine.

PUT/api/v1/secrets/{path}Write a KV secret.
POST/api/v1/creds/{role}Issue dynamic credentials for a role (leased).
POST/api/v1/transit/{key}/signSign a payload with a Transit key (audit-chain signing).
POST/api/v1/transit/{key}/rotateRotate a Transit key to a new version.

AuthZ SS-13

11 operations

Fine-grained authorization — ReBAC tuples, checks, relationship expansion and replayable decisions.

POST/api/v1/checkCheck whether a subject may act on an object.
POST/api/v1/tuplesWrite relationship tuples.
GET/api/v1/expandExpand the relationship graph for an object.
POST/api/v1/decisions/{id}/replayReplay a recorded authorization decision.

SecOps SS-28

56 operations

Detection & response — events, detection rules, hunts, cases, containments and network (Zeek) monitoring.

POST/api/v1/eventsIngest a security event for correlation.
POST/api/v1/rulesRegister a detection rule.
POST/api/v1/cases/{id}/containmentsPropose a containment action on a case.
POST/api/v1/containments/{id}/executeExecute an approved containment.
POST/api/v1/zeek/noticesIngest a Zeek network notice, raising a finding.

GRC SS-34

21 operations

Governance, risk & compliance — controls, evidence intake, findings lifecycle and audit-room rollups.

POST/api/v1/controlsDefine a compliance control.
POST/api/v1/controls/{id}/evidenceAttach evidence to a control.
POST/api/v1/findingsRaise a compliance finding.
GET/api/v1/rollupRead the control-posture rollup for the audit room.

KYC SS-37

9 operations

Identity verification — verification cases, checks, adjudication and ongoing monitoring re-screens.

POST/api/v1/casesOpen a KYC verification case.
POST/api/v1/cases/{id}/checksRun verification checks against a case.
POST/api/v1/cases/{id}/adjudicateAdjudicate a case to a decision.
POST/api/v1/monitoring/rescreenRe-screen a subject against updated watchlists.

Privacy SS-24

15 operations

Privacy & consent — consent capture, purpose gating, DSAR intake and verified erasure.

POST/api/v1/consentCapture a consent decision.
GET/api/v1/can-processCheck whether processing is permitted for a purpose.
POST/api/v1/dsarOpen a data-subject access request.
POST/api/v1/dsar/{id}/execute-erasureExecute a verified erasure across the platform.

A token, a permission check and a signed audit entry

Every request carries an SS-01 bearer and X-Tenant-Id; AuthZ decides it, Vault Transit signs the resulting audit entry, and the decision is replayable forever.

Mint a tokenPOST/api/v1/auth/token

SS-01 issues an access + refresh pair scoped to the tenant.

Check permissionPOST/api/v1/check

AuthZ answers allow/deny from relationship tuples and records the decision.

Sign the evidencePOST/api/v1/transit/{key}/sign

Vault Transit signs the audit-chain entry (ADR-0014).

Replay laterPOST/api/v1/decisions/{id}/replay

Reconstruct exactly why a decision was allowed or denied.

Where it sits in the platform.

Security, Identity & Compliance does not reimplement the platform — it composes it. These are the services it leans on and the seams between them.

Identity (SS-01) + AuthZ (SS-13)

Who you are and what you may do — the front door of every request.

Vault (SS-05)

Secret custody plus the Transit engine that signs the tamper-evident audit chain.

SecOps (SS-28)

Detection, hunts, cases and containment — 56 operations of D&R, including Zeek network monitoring.

GRC · KYC · Privacy (SS-34 / SS-37 / SS-24)

Compliance controls, identity verification and consent/DSAR/erasure over the same tenancy.