Overview

The EGU Partner Portal provides secure external API access for authorized partners to retrieve turnaround report data programmatically using OAuth2 authentication.

How External Access Works

Authentication & Authorization Flow

┌─────────────────┐
│ External System │  1. Request Token
│   (Partner)     │────────────────────┐
└─────────────────┘                    │
                                       v
                              ┌────────────────┐
                              │   Azure AD     │
                              │  Validates:    │
                              │  - Credentials │
                              │  - Role        │
                              └────────┬───────┘
                                       │
                                       │ 2. Issues JWT Token
                                       │    - appid claim
                                       │    - ExternalSystem.Access role
                                       │    - 1 hour expiry
                                       v
┌─────────────────┐
│ External System │  3. Call API with Token
└────────┬────────┘
         │
         v
┌────────────────────────────┐
│  Partner Portal API        │
│                            │
│  ✓ JWT Validation          │
│  ✓ Role Check              │
│  ✓ Route Restriction       │
│  ✓ Company Authorization   │
│                            │
│  → Query Database          │
│  → Return JSON             │
└────────────────────────────┘

Security Layers

1. Authentication: Azure AD validates credentials and issues signed JWT tokens
2. Role Check: Only apps with ExternalSystem.Access role can authenticate
3. Route Restriction: External tokens limited to /api/external/* endpoints
4. Company Authorization: Apps can only access their assigned company data