Content and edge
| Interface | From → to | Protocol | Authentication | Owner | When it fails |
|---|---|---|---|---|---|
| Content API | Next.js → Drupal | JSON:API over HTTPS, X-Domain region header |
None in any environment (these paths are exempt from the CMS password gate) | Axelerant | Last good copy served (6 h), circuit breaker, edge stale copies |
| Path resolution | Next.js → Drupal | decoupled_router /router/translate-path |
As above | Axelerant | As above |
| Edge decision | Localisation Worker → Next.js | Signed x-padi-* request headers (HMAC-SHA256, 300 s skew) |
Shared signing key | Axelerant | Frontend falls back to defaults |
| Cache purge | Drupal → Cloudflare | Cloudflare purge API by cache tag | Cloudflare Global API key | Axelerant | Retries with backoff, dead-letter queue, stale content up to TTL |
| Degraded-page purge | Next.js → Cloudflare | Cloudflare purge API by per-server minute tag | Cloudflare Global API key | Axelerant | Degraded pages expire after 30 s |
| Varnish purge | Drupal → Acquia Varnish | acquia_purge ban by tag | Acquia platform | Acquia | Stale JSON up to 1 h |
| Media | Drupal → Acquia DAM | DAM API, image renditions | DAM integration credentials | PADI (DAM account) | Images missing or slow |
| Travel pages | Routing Worker → PADI Travel | HTTPS proxy | Basic auth on non-prod Travel | PADI Travel | Travel pages unavailable |
Finder and search
| Interface | From → to | Protocol | Authentication | Owner | When it fails |
|---|---|---|---|---|---|
| Finder API | Next.js and browsers → locator-api | HTTPS JSON via Cloudflare | Cloudflare client certificate at the origin | Axelerant | Finder pages show an error section |
| Website search | Browsers → search-api | HTTPS JSON via Cloudflare | As above | Axelerant | Failed result groups are listed as unanswered |
| Search queries | locator-api, search-api → OpenSearch | OpenSearch REST | AWS IAM SigV4 | Axelerant | API reports not ready; load balancer stops routing |
| Content index | Drupal → OpenSearch | OpenSearch REST via search-index.padi.com proxy | Basic auth, fine-grained role limited to content indexes | Axelerant | Website search shows finder results only |
| Travel change data | PADI Travel Aurora → finder | AWS DMS → Kinesis | Cross-account IAM and KMS grant to one role | PADI Travel + Axelerant | Finder data goes stale; serving unaffected |
| Member file | PADI core account → finder | S3 event → EventBridge → SQS | Cross-account EventBridge rule | PADI + Axelerant | Membership changes wait for the next file |
| Places | search-api → Google Places | HTTPS | API key | Google (PADI key) | Suggestions without Google places (800 ms timeout) |
| Maps | Browser → Mapbox | Map tiles | Public token | Mapbox | Map does not render; lists still work |
Identity and member data
| Interface | From → to | Protocol | Authentication | Owner | When it fails |
|---|---|---|---|---|---|
| Sign-in | Browser → account pages → PADI auth gateway → Next.js callback | OAuth redirect; tokens returned to callback | Cognito | Axelerant (account pages, ownership open: Q-15); PADI (Cognito, gateway) | Visitor cannot sign in |
| Session refresh, sign-out, cross-site jump | Next.js → PADI auth gateway | HTTPS | Cognito tokens | PADI | Session kept on network errors, cleared on refusal |
| Single sign-out record | Next.js → session service | GraphQL (AWS AppSync) | API key | PADI | Sign-out completes locally |
| Platform APIs (certifications, profile, profile photo review, course codes with eLearning status, catalog, credentials, forms) | Next.js server → PADI API gateway | HTTPS REST and GraphQL | Machine token (client credentials) | PADI | Module shows unknown or hides; page still renders |
| Diver APIs (eCards, certification photo, logbook, club) | Next.js server → PADI services | HTTPS REST and GraphQL | Member's id token | PADI | As above |
| Course names | Next.js → commercetools | HTTPS | OAuth client credentials | PADI (commercetools) | English names shown |
| Device fingerprint | Browser → Next.js → PADI collector | HTTPS | API key added server-side | PADI | Ignored (fire and forget) |
Translation, consent and monitoring
| Interface | From → to | Protocol | Authentication | Owner | When it fails |
|---|---|---|---|---|---|
| Content translation | Drupal ↔ Crowdin | Crowdin API + webhook, catch-up poll | Personal access token | PADI Localization (Crowdin account) | Jobs retry, alert on stuck jobs |
| Website labels | Developers → Crowdin → repository | Crowdin CLI, committed files | Token on developer machines | Axelerant | No runtime impact |
| Finder text | Pipeline ↔ Crowdin | Crowdin API + webhook | Token | Axelerant | English fallback per text |
| Consent | Browser → TrustArc | TrustArc script | n/a | PADI | Datadog RUM and device fingerprinting do not wait for a consent choice, as PADI's TrustArc notice allows; no effect on either |
| Telemetry | Next.js, Drupal, finder → Datadog | OTLP, Datadog Agent, Lambda extension | Ingest keys per service | Axelerant | Telemetry lost; no user impact |
No interface in this catalogue has a documented SLA or rate limit from its owner. Agreeing these for the PADI platform APIs is an open question.