Generated page. Written from IdaMilk/Suntado_API at commit a9e14cd on 2026-07-28, version 0.0.1. The repository has no README, so everything below is inferred from source.
Suntado API
What is it?
The API Suntado exposes to the outside world. External trading partners authenticate here to obtain a scoped token and then exchange EDI documents.
Its package.json calls it the "Suntado Exposed API" — the only repository in the organisation whose stated purpose is to be reachable by third parties.
Purpose
Trading partners need a way in that does not involve giving them access to internal systems. This service is that door: it authenticates partners, constrains what each one may do through token scopes, rate limits them, and logs every token issued.
How it Works
A partner posts credentials to /auth/token and receives a JWT. Tokens are asymmetrically signed — /auth/public-key serves the public key from config/keys/public.pem, so partners can verify tokens without holding any shared secret. The private key stays server-side.
Every issued token is recorded in partnerTokenLog, giving a per-partner audit trail of when access was granted.
Requests then pass through a middleware chain: requestLogger → rateLimiter → auth → scope → controller. scope.middleware.js is the important one — a valid token is not sufficient, it must also carry the scope the endpoint requires. Partner A holding a token cannot reach Partner B's operations.
Rate limiting is applied per named bucket rather than globally; /auth/token carries its own 'auth' bucket, so credential-stuffing against the token endpoint is throttled independently of ordinary traffic.
API
| Method | Path | Auth | Purpose |
|---|---|---|---|
POST | /auth/token | credentials | Issue a scoped JWT |
GET | /auth/public-key | public | Public key for verifying issued tokens |
POST | /edi/* | Bearer + scope | EDI document exchange |
GET | /test | public | Connectivity check |
Data model
| Model | Holds |
|---|---|
partner | Registered trading partners and their credentials |
partnerTokenLog | Audit log of issued tokens |
Tech Stack
| Technology | Version | Purpose |
|---|---|---|
| Express | ^5.2.1 | HTTP framework |
| jsonwebtoken | ^9.0.3 | Asymmetric JWT |
| bcrypt | ^6.0.0 | Credential hashing |
| express-rate-limit | ^8.2.1 | Per-bucket rate limiting |
| Sequelize | ^6.37.7 | ORM |
| tedious | ^19.1.3 | SQL Server driver |
| axios | ^1.13.2 | Outbound HTTP |
| uuid | ^13.0.0 | Identifiers |
| cors | ^2.8.5 | Cross-origin support |
Dependencies are declared as caret ranges here, unlike the pinned versions used across the SunApps services — so an install can pick up newer minors than were last tested.
Interfaces
| System | Direction | Purpose |
|---|---|---|
| Trading partners | inbound | Token issuance and EDI exchange |
| Suntado EDI | outbound | Document processing |
| SQL Server | outbound | Partner records and token log |
Operations
Deployed by GitHub Actions — development, production and tagging workflows — and run under a process supervisor via ecosystem.config.js.
Configuration is split between config/env.js and config/db.js. tools/hash.js generates credential hashes when onboarding a partner.
Two things to be aware of:
- The version is still
0.0.1despite being the internet-facing surface, and the last commit predates most of the platform (December 2025). Either it is stable and finished, or it is not receiving the attention its exposure warrants — the repository alone cannot tell you which. config/keys/public.pemis committed, which is correct — it is a public key and must be distributable. Confirm the corresponding private key is supplied at deploy time and is not in the repository history.
Repository
| Repository | IdaMilk/Suntado_API |
| Version | 0.0.1 |
| Primary language | JavaScript (Node, CommonJS) |
| Files | 25 |
| Last activity | 2025-12-10 |
| Status | Active — externally exposed |
| README | None |
Given this is the only externally reachable service, a README covering partner onboarding, scope definitions and token lifetimes would be the highest-value documentation in the organisation.