API reference
Key endpoints, auth patterns, rate limits, and known limitations for each credential provider API. Derived from HID Origo API docs, Wavelynx v1.0.12, and LEGIC Connect documentation. Click endpoints marked ▼ for integration notes.
HID Origo
v3.x (Pass) · v2.2 (SCIM legacy)
https://origo.hidglobal.comBearer tokens obtained via client_credentials grant. Rate-limited to 50 requests / 5 minutes per organizationId. Tokens are cached within TTL — never request a new token per API call. HID returns HTTP 403 (not 429) on rate-limit exceeded.
Returns HTTP 403 on limit exceeded — not 429. Parse error body to distinguish from auth 403.
Webhooks
CloudEvents v1.0 via HTTPS POST. Delivers lifecycle events (issued, suspended, revoked). No retry on failure — events are lost if endpoint is unreachable.
Known limitations
- ▸HTTP 403 returned on rate-limit, not 429 — standard retry logic misidentifies as auth failure.
- ▸CloudEvents have no retry or replay — polling fallback required.
- ▸v2.2 SCIM and v3.x Pass use separate identity spaces — do not mix in the same flow.
- ▸All four onboarding artifacts (Instance, Service Account, MOB Key, App-ID) must be active before issuance.