> ## Documentation Index
> Fetch the complete documentation index at: https://tatallo-docs.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Security

> How access works, what an ID is and isn't, and how to report a vulnerability.

## How access works

Three things must all hold before your PMS sees a property:

```mermaid theme={null}
flowchart LR
  K["Your PMS credential<br/>(valid, this environment)"] --> S["Scope<br/>properties:read"]
  S --> C["The property is connected to your PMS<br/>by its host"]
  C --> P["You can list and read it"]
```

1. **PMS credential.** The key is valid, current and belongs to the environment you call.
2. **Scope.** The key carries the scope the route needs: `properties:read` to list and read properties.
3. **Connection.** The property's host has connected that property to your PMS. A scope never grants a property by itself.

If any of the three fails, you get `401`, `403` or `404` respectively. A property you may not see answers exactly as one that does not exist.

## A property ID is not a credential

A property `id` is an identifier. Knowing it grants nothing: only the three conditions above do. You can store and log IDs freely, but treat your PMS credential as a secret (see [Authentication](https://tatallo-docs.mintlify.site/get-started/authentication.md)).

## Data minimisation

The API shares only what a PMS needs to map a property. See [Data ownership](https://tatallo-docs.mintlify.site/concepts/data-ownership.md) for what is never shared.

## Reporting a vulnerability

If you find a security issue in the Tatallo PMS API or this site, email [developers@tatallo.com](mailto:developers@tatallo.com) with **Security** in the subject. Please don't disclose it publicly, and don't access data that isn't yours while investigating. Include what you found, how to reproduce it, and any request IDs. Tatallo confirms receipt and keeps you informed until it is fixed.

If you believe one of your keys leaked, say so in the first line: Tatallo revokes it at once and issues you a new one.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.