Direct Data Sharing (DDS) Credentials Management API Overview

This API can be used to manage tokens for accessing Zalando data via the delta sharing protocol. The full technical details of the API and the available endpoints are summarized in the Direct Data Sharing Credentials Management API Reference.

Caution

Delta sharing tokens (.share files) enable access to sensitive data. They should be treated as highly confidential.

  • Never share your tokens in an insecure medium such as email or chats.
  • Never store your tokens locally or in your code repository in unencrypted files.
  • In case your tokens are exposed you should immediately revoke them using the PATCH /dds-tokens method on this API with a payload {"existing_token_expiry_time_in_seconds": 0}

Note

The delta sharing tokens that can be managed using this API are separate from the zDirect access tokens that are a prerequisite for calling the API (see Authentication Overview for more information on the latter). For the avoidance of confusion we refer to delta sharing tokens and zDirect access tokens explicitly in the following sections.

Note

Direct Data Sharing is currently available only to selected partners. Interested partners should contact their partner consultants for onboarding information.

API Scopes

Calls to the Direct Data Sharing Credentials Management API must be authenticated with a zDirect access token that includes the Direct Data Sharing APIs / dds scope. Read permissions are necessary for GET requests (retrieve delta sharing tokens) while Write permissions are necessary for PATCH and POST requests (which update and rotate delta sharing tokens, respectively).

This API also requires that the authenticated client application is configured with access to all of the merchants associated with the Fashion Partner account.

For more information on configuring client applications with scopes and merchants see Creating and Managing Apps.

For information about how to authenticate calls to zDirect Platform APIs see Authentication Overview.

Rate Limiting

You may only make the following number of requests per second:

Request req/sec (sandbox) req/sec (production) rate-limit quota
GET dds-tokens 1 1 per Fashion Partner
PATCH dds-tokens 1 1 per Fashion Partner
POST dds-tokens 1 1 per Fashion Partner

Requests that exceed these limits will recieve an HTTP 429 "Too Many Requests" status code. For more information, see Rate Limiting.

Sandbox Behavior

A sandbox version of the API is provided in order to test integration and functionality without risking compromising production delta sharing tokens.

For information on how to configure your client application for sandbox mode, see Sandbox Testing.

Note

A separate delta sharing recipient is used in the sandbox environment. This recipient does not have access to any data and is provided only for demonstration of the API functionality. Delta sharing tokens for the sandbox recipient behave in exactly the same way as delta sharing tokens for production recipients, however, as the sandbox recipient is shared by multiple end users it is possible that consecutive API requests by a given user will yield unexpected responses if another user is making requests to the sandbox API simultaneously.

Delta sharing tokens generated using the sandbox API can be activated and downloaded as usual but will not grant access to any data through delta shares. They must not be used in production systems.

Delta Sharing Resources

The tokens that can be obtained via this API enable users to access data via Delta Sharing. The following resources may be useful for getting started:

Contact Support