Integration patterns

The public API is protocol-based and does not require an Alution-specific SDK. Use maintained libraries appropriate for your runtime.

HTTP requirements

Your client must support JSON, multipart uploads, binary streaming, and the Authorization header. To use modern search endpoints, it must also preserve the HTTP QUERY method and a JSON request body; test intermediaries such as proxies and gateways because some older products reject unfamiliar methods.

Implement timeouts, bounded retries for transient failures, and safe handling of 429 responses. Do not retry validation, authorization, or OAuth grant errors without changing the request.

OAuth client requirements

Choose an OAuth 2.0 client that supports Authorization Code with PKCE using S256, a per-request state value, refresh-token rotation, and public clients without a client secret. Browser and mobile applications must not embed a secret. See Authentication for the exact flow.

Realtime client requirements

Use a WebSocket client that supports private-channel authorization through /broadcasting/auth. Obtain the connection host, port, scheme, and application key for the tenant environment. The OAuth application supplies access through the realtime:connect scope.