Mindtickle Prod Checklist

• API keys stored in vault/secrets manager (never in code or config files)
• Key rotation schedule configured (every 90 days)
• SCIM bearer token stored separately from general API keys
• X-Company-Id header injected server-side (never exposed to client)
• Service account permissions restricted to required modules only (courses, users, analytics)

API Integration

• Base URL points to https://api.mindtickle.com/v2 (production, not sandbox)
• X-Company-Id header included on every request for tenant isolation
• Rate limiting enforced client-side (respect X-RateLimit-* response headers)
• Pagination implemented for user and course listing (offset-based with limit and offset)
• SCIM provisioning endpoint handles bulk operations (batch user create/update)
• Request timeout set to 10 seconds for reads, 60 seconds for bulk SCIM operations
• Course progress sync uses incremental timestamps (not full resync each run)

Error Handling & Resilience

• Circuit breaker configured for MindTickle API calls (open after 5 consecutive failures)
• Retry logic with exponential backoff for 429 (rate limit) and 5xx responses
• SCIM conflict resolution: 409 on duplicate user triggers update-or-skip logic
• Quiz submission failures queued for retry (never silently dropped)
• Bulk provisioning errors isolated per-user (one failure does not abort the batch)
• Stale company ID detection: 403 triggers re-verification of tenant configuration
• Course progress writes are idempotent (safe to replay on retry)

Monitoring & Alerting

• API latency tracked (p50, p95, p99) with 1s p95 threshold
• Error rate alerts configured (threshold: >1% over 5-minute window)
• SCIM provisioning success rate monitored (alert if <99% over 1 hour)
• Quiz completion event delivery lag tracked (alert if >5 min behind real-time)
• User count drift between IdP and MindTickle detected daily (reconciliation job)
• Course enrollment failures logged with user ID and course ID for manual review

Security

• Multi-tenant isolation verified: requests scoped by X-Company-Id at API gateway level
• SCIM webhook signatures validated before processing provisioning events
• PII fields (email, name, manager) encrypted in transit and at rest in local cache
• Quiz score data access restricted by role (managers see team only, not cross-org)
• Audit log enabled for all SCIM create/update/deactivate operations
• Data retention policy enforced: purge local user data within 30 days of deprovisioning

Validation Script

async function validateMindTickleProduction(apiKey: string, companyId: string): Promise<void> {
  const base = 'https://api.mindtickle.com/v2';
  const headers = {
    Authorization: `Bearer ${apiKey}`,
    'X-Company-Id': companyId,
    'Content-Type': 'application/json',
  };

  // 1. Connectivity check
  const ping = await fetch(`${base}/health`, { headers, signal: AbortSignal.timeout(5000) });
  console.assert(ping.ok, `API unreachable: ${ping.status}`);

  // 2. Auth and tenant validation
  const users = await fetch(`${base}/users?limit=1`, { headers });
  console.assert(users.status !== 401, 'Invalid API key');
  console.assert(users.status !== 403, 'Company ID rejected — check tenant config');
  console.assert(users.ok, `Users endpoint failed: ${users.status}`);

  // 3. Rate limit headroom
  const remaining = parseInt(users.headers.get('X-RateLimit-Remaining') ?? '0');
  console.assert(remaining > 20, `Rate limit headroom low: ${remaining} remaining`);

  // 4. SCIM endpoint reachable
  const scimUrl = process.env.MINDTICKLE_SCIM_URL;
  if (scimUrl) {
    const scim = await fetch(`${scimUrl}/Users?count=1`, {
      headers: { Authorization: `Bearer ${process.env.MINDTICKLE_SCIM_TOKEN}` },
      signal: AbortSignal.timeout(5000),
    });
    console.assert(scim.ok, `SCIM endpoint failed: ${scim.status}`);
  }

  // 5. Course listing works
  const courses = await fetch(`${base}/courses?limit=1`, { headers });
  console.assert(courses.ok, `Courses endpoint failed: ${courses.status}`);
  console.log('All MindTickle production checks passed');
}

Risk Matrix

Resources

• MindTickle Platform Integrations

Next Steps

See mindtickle-security-basics.