API Management Via Facilisight Application

| Overview

API Management provides a centralized interface within Facilisight for managing API subscription credentials and monitoring API consumption.

The feature enables administrators and authorized support users to access subscription keys required by external applications to authenticate API requests to the 75F platform. API credentials are organized by API category, allowing integration teams to manage access to different API capabilities from a single location.

API Management also provides API usage monitoring and an integrated API Trial environment, allowing developers and integrators to validate API functionality before implementing an external integration.

Note: API Management is available as a subscription-based add-on. The feature must be enabled through the applicable subscription process before its capabilities become available.

| Purpose

API Management simplifies and centralizes the administration of API access for the 75F ecosystem.

It provides a controlled mechanism to:

• Access API subscription credentials.
• Manage authentication keys for different API categories.
• Securely view and copy API keys.
• Monitor API consumption.
• Test API endpoints before integration.
• Support external application integrations.
• Rotate credentials with minimal service interruption.

| Accessing API Management

API Management is accessed from the Facilisight portal.

Navigation

Building Options → API Management

From the API Management page, select the API Keys section to view the available API credentials.

Access to API credentials is controlled through user permissions and certification levels.

| API Categories

API subscription keys are organized into separate API groups.

Read API

Provides authentication credentials for APIs used to retrieve information from the 75F platform.

Write API

Provides authentication credentials for APIs used to modify or write information to the platform.

Special Schedule API

Provides authentication credentials for APIs associated with schedule-related operations.

Separating APIs into logical categories simplifies credential administration and helps integration teams identify the appropriate credentials for their integration requirements.

| API Subscription Keys

Each API category provides subscription key credentials for authenticating API requests.

Primary Key

The Primary Key is the default subscription key used by external applications to authenticate API requests.

The API Management interface provides controls for securely interacting with the key.

Key Visibility

Subscription keys are masked by default.

Users with the required permissions can select the Eye icon to reveal the complete key.

Selecting the icon again masks the key.

This behavior reduces accidental exposure of credentials while allowing authorized users to verify the key when necessary.

Copying a Key

The Copy icon allows an authorized user to copy the subscription key directly to the clipboard.

The copied credential can be used with:

• Postman
• REST clients
• Integration middleware
• Custom applications
• Automation scripts

Copying the key directly reduces manual entry and minimizes authentication errors.

| API Key Rotation

API Management supports two interchangeable authentication keys for each API.

This enables credentials to be rotated while minimising service interruption.

A typical rotation approach is:

1. Use the currently active key for production traffic.
2. Generate or configure the replacement key.
3. Update the external application with the replacement credential.
4. Validate API authentication.
5. Retire the previous credential when it is no longer required.

The availability of two interchangeable keys supports controlled credential rotation and reduces the need for downtime during key changes.

| API Usage

The API Usage section provides visibility into API consumption for the selected date range.

It enables administrators and authorized users to:

• Review API activity.
• Monitor API consumption.
• Analyze usage metrics.
• Understand API utilization for a site.
• View request activity categorized by API type.

A date-range selector allows users to filter the usage information for a specific period.

API consumption is also tracked as part of the APIM workflow for reporting and billing purposes.

| API Trial

The API Trial section provides an integrated environment for exploring and testing available APIs directly from Facilisight.

The API Trial interface is powered by Swagger using the OpenAPI Specification 3.0.

It allows developers and integrators to:

• Explore available API endpoints.
• Review request schemas.
• Review response schemas.
• Execute API requests.
• Validate API behavior.
• Test API functionality before developing an external integration.

This provides a built-in developer experience without requiring users to rely exclusively on external API testing tools.

L1 Integrator Experience

For an L1 integrator, the subscription keys are prefilled in the API Trial environment.

The user can select Try It Out to execute the available APIs without manually entering the subscription credentials.

| Access Control

API Management uses role-based access and certification requirements to control access to API credentials and integration capabilities.

Users with the required L3 integrator certification can:

• View API keys.
• Reveal masked API keys.
• Copy API keys.
• Run API trials.

Users who do not have the required certification permissions cannot access the API credentials.

| APIM Add-on Flow

API Management is delivered as an optional add-on.

The overall enablement and consumption flow is:

The APIM flow uses both subscription status and role/certification permissions to control access to API capabilities.

| External Application Integration

API subscription keys are intended to authenticate external applications when communicating with the 75F platform.

A typical integration workflow is:

1. Enable the API Management subscription.
2. Navigate to Building Options → API Management.
3. Identify the required API category.
4. Retrieve the applicable subscription key.
5. Copy the key securely.
6. Configure the key in the external API client or application.
7. Test the integration using API Trial or an external API client.
8. Monitor API usage through the API Usage section.

The API Management feature therefore acts as the credential-management layer between the Facilisight platform and external integrations.

| Security Considerations

API subscription keys provide authenticated access to APIs and should therefore be treated as sensitive credentials.

Key Protection

Subscription keys are masked by default and must be explicitly revealed by an authorized user.

Access Control

API credentials are available only to users with the appropriate permissions and certification level.

Secure Storage

Copied credentials should be stored using an approved credential manager or secure secrets vault rather than in source code, documentation, emails, or publicly accessible locations.

Credential Rotation

API keys should be rotated periodically according to the organization's security policies. The two-key model supports credential rotation with minimal disruption.

| UI Components

The API Management interface groups credentials and supporting capabilities into a single administration experience.

| Functional Behaviour

| Operational Considerations

Subscription Dependency

API Management is an optional subscription-based capability. Users must have the APIM add-on enabled before they can access its functionality.

Certification Dependency

Access to subscription credentials is governed by user permissions and certification levels.

Usage Monitoring

API activity is tracked to provide visibility into API consumption and support reporting and billing.

Credential Management

Integration teams should maintain appropriate ownership and lifecycle management for subscription credentials.

| Best Practices

For secure and reliable API integrations:

• Keep subscription keys confidential.
• Do not expose keys in publicly accessible repositories.
• Store credentials in a secure secrets-management solution.
• Grant API Management access only to authorized users.
• Rotate credentials periodically.
• Use the API Trial environment to validate API behavior before implementing an integration.
• Monitor API usage regularly.
• Select the API category appropriate to the integration requirement.
• Remove or retire credentials that are no longer required.

These practices align with the security and operational recommendations provided for API Management.

| Key Benefits

Centralized Credential Management

Provides a single location for viewing and managing API subscription credentials.

Simplified Integration:

Allows authorized users to copy authentication credentials directly into API clients and integration applications.

Secure Access

Masks credentials by default and restricts access based on permissions.

Developer Enablement

Provides an embedded Swagger/OpenAPI 3.0 testing environment for exploring and validating APIs.

Operational Visibility

Provides API consumption information and supports usage monitoring.

Reduced Integration Downtime

The two-key model supports controlled credential rotation with minimal service interruption.

The feature also supports operational governance through usage tracking, credential rotation, and controlled access to API credentials.