Device capability discovery
Inputs, outputs, timeout, errors and evidence are defined in the contract.
ID/NFC
Chip ID, NFC and Identity Reader Integration
Standardize document-reading capabilities, device state, timeout, errors and evidence through HAL and device adapters.
INTEGRATION CONTRACT
Define the integration contract before the PoC
Policy-controlled reading
Inputs, outputs, timeout, errors and evidence are defined in the contract.
Masking and restricted logging
Inputs, outputs, timeout, errors and evidence are defined in the contract.
Fallback when the reader is unavailable
Inputs, outputs, timeout, errors and evidence are defined in the contract.
DATA FLOW · TRUST BOUNDARYSession startCreate correlation ID and policy context. AuthenticationApp, device and user identity as required. ExecutionKioWare calls the connector or capability API. ResultValidate response, callback or event. ReconciliationPrevent duplicate submission and resolve unknown outcomes. EvidenceRecord audit metadata without secrets.
Reference flow and control points
Principle: Do not place secrets, OTPs, PINs or full sensitive values in logs, URLs or QR codes.
API · SECURITY · OPERATIONS
Questions to answer in the Technical Workshop
API contract
Authentication, versioning, timeout, retry, idempotency and errors.
Data & privacy
Data minimization, masking, retention, consent and jurisdiction.
Operations
Monitoring, incidents, support, releases, DR and responsibility split.
RESPONSIBILITY MATRIX
Assign responsibility before build
| Mobile-ID / KioWare | Runtime, HAL/adapter framework, policy enforcement, telemetry and UAT guidance. |
|---|---|
| Customer / SI | Business APIs, test data, backend environment, approvers and business acceptance criteria. |
| Shared | Threat model, performance testing, incident route, release plan and production readiness. |
PREREQUISITES
Inputs to prepare
Architecture
Network zones, gateways, identity, data flow and deployment.
Contract
OpenAPI/schema, authentication, rate limits, timeout, errors and callbacks.
Test & Operations
Test data, device models, support contacts, monitoring and DR.
UAT EVIDENCE
Accept normal and exception scenarios
- Happy path with end-to-end trace ID.
- Timeout, network loss, delayed callback and retry.
- Submitted request with an unknown outcome.
- Session revocation, temporary-data purge and audit evidence.