Impact Exact Online API adjustments July 1, 2021

[forums]

Update July 6

No more than 10 error messages per app, administration, endpoint and hour

The following new limit was turned on July 5 and fully enabled:

@forums

No more than 10 error messages per app, administration, endpoint and hour.

An analysis has been made of this. According to the latest version of the specifications, only 400 (Bad request), 401 (Unauthorized), 403 (Forbidden) and 404 (Not Found) HTTP status codes are counted. Busines errors returned as HTTP 500, 503 or otherwise do not count according to the analysis. It was not analyzed whether, for example, document attachment retrieval runs in these counts.

Occasionally Exact Online will return a bad request wrongly, but with Invantive SQL mainly 401 or 403 will occur: obtaining a new access token is delayed maximally, both for the implicit grant flow and the code grant flow. This generates a maximum of 6 errors per hour. The logic will be modified via ITGEN-5408.

Maximum 200 token endpoint calls

Starting July 12, the following matching restrictions are expected to be gradually enabled over several weeks via a central adjustment:

@forums

• Maximum 200 token endpoint calls per app, user and day: implicit grant flow at login and every ten minutes, retrieve access token based on code from code grant flow, retrieve access token via refresh token from code grant flow.
• Maximum of 1 access token generation every 9.5 minutes, but do not wait for HTTP 401 error message (see next point).

Implementation will be gradual across countries.

Mandatory filter

The mandatory filter if a sync API is available will be enabled via a phased rollout starting in mid-July:

@forums

• Mandatory filter on single and bulk endpoints if a sync API is available (see Exact Online: is mandatory filtering by client ID configurable? ).

Other

For the following changes, we are not yet clear what is enabled or when it will be enabled:

@forums

• Maximum 60 calls per minute instead of 300 calls per minute: this is a limit across both XML and REST APIs. If exceeded, the number of calls per minute is automatically reduced.
• Issued refresh tokens will expire 30 days after the last access token exchange.
• No more exceptions in terms of using old refresh tokens.

Impact Invantive Products

Currently, all Invantive products are working undisturbed. There will be no meaningful test environment against which the Invantive software can be certified.

At this time, it is not predictable if and when software will go down. Due to the vacation season, a down situation may take a longer period of time.

We are taking into account a production stop which for a part of the users may last up to 3 months after enable last change.

As soon as more information is known it will be shared here.