On this page
API security boundaries
Read-only API access is designed for limited retrieval of records and published deliverables within a scope approved and provisioned by Clearline. It is optional, tenant-scoped, and disabled unless provisioned by Clearline.
This overview describes the customer-facing limits of Clearline LIMS read-only API access. Security controls, isolation, logging, rate limits, and implementation details are confirmed during provisioning before access is enabled.
Customer responsibilities#
Organizations using read-only API access are responsible for:
- naming a business owner and technical owner;
- storing credentials securely;
- limiting access to approved systems and personnel;
- rotating credentials when ownership or vendor access changes;
- reporting suspected credential exposure quickly;
- validating downstream storage, retention, and access controls for downloaded data.
Credential handling#
Do not place API credentials in:
- email messages;
- screenshots;
- support tickets;
- source control;
- shared spreadsheets;
- browser bookmarks;
- client-side JavaScript;
- public configuration files;
- chat transcripts.
Use a server-side secret store or other approved credential-management process for your tenant.
Tenant and data scope#
Clearline provisions credentials for a confirmed tenant and approved data scope. API access is configured to limit responses to records available within that provisioned scope.
If your organization needs to change scope, add a vendor, expand a data area, or connect a new system, contact Clearline Support before changing the integration.
Excluded operations#
Read-only API access must not be used for:
- sample creation or registration;
- sample receipt or chain-of-custody changes;
- result entry, import, amendment, or deletion;
- review, verification, publication, retraction, or workflow changes;
- report generation or regeneration;
- user, role, group, permission, or account administration;
- setup, master-data, or billing changes;
- raw internal or administrative routes;
- unapproved bulk export.
Those workflows require a scoped implementation review and are not standard customer read-only API access.
Monitoring and support#
Clearline may require usage expectations, rate limits, token rotation intervals, and support escalation details during onboarding.
When escalating an API issue, include sanitized request details and the operational impact. Never include credentials or sensitive downloaded data in the ticket.