



Have any questions? We’re here to help You
Makini's unified API acts as a common denominator across all connected systems. We map each system's data structure to a standardized data model, exposing consistent endpoints regardless of the underlying platform. This means you write the same code to retrieve purchase orders from SAP, NetSuite, or Dynamics—the API calls and response formats are identical. You always get data in the same structure, making it easy to build consistent business logic. The unified approach eliminates the need to learn each system's unique API, manage multiple authentication methods, or handle varying data formats.
Makini is SOC 2 Type 2 compliant and undergoes penetration testing twice annually. We use industry-standard encryption protocols including TLS 1.2+ for data in transit and AES-256 for data at rest. Customer credentials are encrypted using secure key management practices. Our infrastructure follows security best practices including network segmentation, access controls, and regular security audits. For highly regulated industries or customers with strict compliance requirements, we offer self-hosted deployment options that keep all data within your infrastructure. We've successfully met security requirements for enterprises including financial institutions and government contractors.
All Makini webhooks include a signature header for verification. The signature is an HMAC hash of the webhook payload using your webhook secret as the key. To verify a webhook, compute the HMAC using your secret and compare it to the signature header using constant-time comparison to avoid timing attacks. Never process webhook data without verification, as this could expose your system to forged requests. Your webhook secret is provided when you configure webhooks and should be stored securely. Webhook verification ensures that only legitimate requests from Makini are processed by your application.
Write operation limitations vary by system. Common limitations include: field-level restrictions (some fields may be read-only), business rule validation (orders may require certain fields or valid vendor codes), permission requirements (the connected account needs specific permissions), timing restrictions (some systems prevent modifications after certain workflow states), and rate limits on write operations. Custom fields in target systems may not be writable through standard APIs. Some systems have transactional requirements—for example, purchase order line items must be created in the same transaction as the order header. During implementation, we identify write operation limitations for your specific use cases and design workflows that work within those constraints.
