Express courier. Direct.
Also overnight.
x25pronto Switzerland takes goods direct to the destination. Small loads go by car. Larger loads go by van or Van XL. Direct, express and overnight trips run Monday to Sunday when a slot is free. Free times are shown in the booking calendar. This keeps the plan clear.
API security checklist for courier integrations
A concise, technical checklist for developers: test authentication, rate limiting, payload validation, logging and SLA tests when integrating courier APIs.
Quick answer
This checklist lets developers evaluate the security of a courier API quickly and methodically. Key areas: strong authentication, rate limiting, payload validation, structured logging and SLA testing. Run these checks in dev and staging before sending live bookings to x25pronto or other courier services.
1. Authentication and authorization
Verify which auth methods the API supports (API keys, OAuth2, JWT). Test expired and revoked credentials. Ensure each request has the right permissions for endpoints. Check roles and scopes: who can create bookings, cancel or read data? Prefer short‑lived tokens, implement refresh flows and document key rotation cycles.
2. Transport security and TLS
Encrypted transport is mandatory. Enforce HTTPS with modern TLS versions. Test that plain HTTP is rejected. Validate certificate chains, HSTS and forward secrecy. Monitor certificates to detect expiry early.
3. Rate limiting and throttling
Determine allowed request rates per API key or IP. Simulate bursts and observe behaviour when limits are exceeded: status codes (e.g. 429), Retry‑After headers and backoff behaviour. Test that limits are enforced fairly and that critical endpoints (booking creation) may have distinct rules.
4. Payload validation and input sanitation
Validate all inputs on the server side. Use schema validation (JSON Schema) for required fields, types and ranges. Test common attacks: SQL/NoSQL injection, XSS in free text fields and oversized payloads. Reject unexpected fields and return clear but non‑leaking error messages.
5. Authenticity, integrity and non‑repudiation
Make critical events like booking creation or cancellation auditable and tamper‑resistant. Verify webhook signatures and HMAC headers so incoming notifications are accepted only from trusted systems. Log request IDs or transaction hashes for audit and reconciliation.
6. Logging, monitoring and access control
Collect structured logs for requests, response codes and latency. Mask sensitive data (e.g. payment or personal details) in logs. Set alerts for anomalies such as sudden rate spikes or recurrent 5xx errors. Enforce least‑privilege access to logs and monitoring dashboards.
Frequently asked questions
How do I test webhook signatures in practice?
Simulate webhook calls from a test source using valid and tampered HMAC hashes. Verify the API accepts only correct signatures and rejects altered requests. Document the signature algorithm, expected header name and allowed time skew.
Which status code should rate limits return?
The common standard is HTTP 429 Too Many Requests. Include a Retry‑After header where possible. Use a consistent error payload with a code, message and optional remaining quota.
How should I handle sensitive customer data in logs?
Mask or strip personal data before writing logs. Apply field redaction, e.g. keep only last four digits of a phone number. Store full records in access‑controlled stores and document retention rules.
How to run SLA tests for a courier API?
Automate synthetic tests that exercise typical calls (create booking, status check, cancel) at set intervals. Measure response times, error rates and success ratios. Run tests off‑peak and during load windows. Compare measured metrics to contractual SLA targets.