Event Intake
Decisions arrive through four channels — REST, ISO 8583, message queues and flat files. Every request is authenticated, scoped to one institution and validated before any rule runs.
Request Handling
request
-> look up organization by x-org-id
-> compare x-api-key in constant time
mismatch -> 401
-> per-route and global rate limits
exceeded -> 429
-> validate body against the channel schema
invalid -> 400
-> map to rule facts (stage 02)
Channels
REST JSON, raw ISO 8583 (binary or hex, optional length framing), Kafka/AMQP consumers with HMAC-signed messages, and a flat-file batch watcher.
Authentication
API key checked with constant-time comparison after looking up the organization, which removes timing signals about whether a key or organization exists.
Perimeter
Per-organization IP blocks are enforced on API requests. The in-process request scanner is advisory; a dedicated edge WAF is expected in front of QUORUM in production.
Limits
No latency figure is claimed for intake. Per-channel latency will be measured under a defined load during a pilot.