Integrating sensitive data from a data provider into instances of third-party applications executed on user devices

1. A system comprising:

a telecommunications network server comprising:

a processor,

a network communications port configured for being controlled by the processor and for communicating, via a data network, with a third-party system and a user device, and

a non-transitory computer-readable storage device included in or communicatively coupled to the telecommunication network server, the non-transitory computer-readable storage device comprising (i) a data provider service with a data provider application program interface (“API”), (ii) a data structure storing user data records with information about a user, and (iii) instructions that are executable by the processor to:

receive, via the network communications port and from the third-party system, an authentication API call addressed to an authentication endpoint of the data provider API, the authentication API call identifying a user identifier of the user;

determine, from the user identifier included in the authentication API call, that the user is authorized to access one or more features of the data provider service;

configure the network communications port to transmit, to the third-party system, response information indicating the user identifier;

receive, via the network communications port and from the user device, a feature API call addressed to a feature endpoint of the data provider API, the feature API call generated by an instance of a web-based application that is controlled by the third-party system, wherein the instance is executed at the user device;

generate, based on the feature API call including the response information and requesting performance of the one or more features, user-specific output data from the user data records by performing the one or more features; and

configure the network communications port to transmit the user-specific output data to the user device in a format displayable by the instance of the web-based application.

2. The system of claim 1 , wherein the instructions are further executable by the processor to generate the user identifier by performing, prior to a receipt of the authentication API call, operations comprising:

receiving, via the network communications port and from the third-party system, an enrollment API call addressed to an enrollment endpoint of the data provider API, the enrollment API call requesting that the user be authorized to access the data provider service;

verifying an identity of the user based on (i) authentication data included in the enrollment API call and (i) at least some of the information about the user from the user data records;

generating the user identifier; and

configuring the network communications port to transmit the user identifier to the third-party system.

3. The system of claim 2 , wherein the enrollment API call further includes data authorizing the user to access an additional feature available from the data provider service.

4. The system of claim 1 , wherein the instructions are further executable by the processor to:

generate an access token that includes the response information, wherein transmitting the response information includes transmitting the access token to the third-party system;

determine that the feature API call includes the access token;

verify that the access token included in the feature API call has not expired;

determine that the access token included in the feature API call is associated with the user identifier; and

verify that the user identifier is associated with an authorization for the one or more features.

5. The system of claim 1 , wherein the instructions are further executable by the processor to:

determine that an additional user identifier included in an additional authentication API call does not match any user data record stored in the data structure; and

responsive to determining that the additional user identifier does not match any user data record, configure the network communications port to transmit, to the third-party system, an error indicating a failure to authenticate an additional user associated with the additional user identifier.

6. The system of claim 1 , wherein the processor is configured to determine that the user is authorized to access one or more features of the data provider service by performing operations comprising:

determining a requested feature included in the authentication API call; and

determining that the requested feature is in a set of enrolled features associated with the user identifier.

7. The system of claim 1 , wherein:

the authentication API call identifies a scope of operation of the data provider service,

the one or more features are within the scope of operation, and

the feature API call indicates that the response information has the scope of operation.

8. The system of claim 1 , wherein generating the user-specific output data is responsive to determining that the one or more features are within a scope of operation associated with the response information.

9. A method comprising operations executed by one or more processing devices, the operations including:

receiving, by a data provider service and via a data provider service application program interface (“API”), an authentication API call addressed to an authentication endpoint of the data provider API, the authentication API call identifying a user identifier of a user, the authentication API call being received from a third-party system;

determining, from the user identifier in the authentication API call, that the user is authorized to access one or more features of the data provider service;

transmitting, to the third-party system, response information indicating the user identifier;

receiving, by the data provider service and from a user device, a feature API call addressed to a feature endpoint of the data provider API, the feature API call generated by an instance of a web-based application that is controlled by the third-party system, wherein the instance is executed at the user device;

generating, based on the feature API call including the response information and requesting performance of the one or more features, user-specific output data from one or more user data records by performing the one or more features; and

transmitting the user-specific output data to the user device in a format displayable by the instance of the web-based application.

10. The method of claim 9 , the operations further including generating the user identifier by performing, prior to a receipt of the authentication API call, additional operations comprising:

receiving, from the third-party system, an enrollment API call addressed to an enrollment endpoint of the API, the enrollment API call requesting that the user be authorized to access the data provider service;

verifying an identity of the user based on (i) authentication data included in the enrollment API call and (i) information about the user from the user data records;

generating the user identifier; and

transmitting the user identifier to the third-party system.

11. The method of claim 9 , the operations further including:

generating an access token that includes the response information, wherein transmitting the response information includes transmitting the access token to the third-party system;

determining that the feature API call includes the access token;

verifying that the access token included in the feature API call has not expired;

determining that the access token included in the feature API call is associated with the user identifier; and

verifying that the user identifier is associated with an authorization for the one or more features.

12. The method of claim 9 , the operations further including:

determining that an additional user identifier included in an additional authentication API call does not match any user data record; and

responsive to determining that the additional user identifier does not match any user data record, transmitting, to the third-party system, an error indicating a failure to authenticate an additional user associated with the additional user identifier.

13. The method of claim 9 , wherein determining that the user is authorized to access one or more features of the data provider service includes:

determining a requested feature included in the authentication API call; and

determining that the requested feature is in a set of enrolled features associated with the user identifier.

14. The method of claim 9 , wherein:

the authentication API call identifies a scope of operation of the data provider service,

the one or more features are within the scope of operation, and

the feature API call indicates that the response information has the scope of operation.

15. A non-transitory computer-readable medium embodying program code for integrating authenticated user-specific output in a web-based application controlled by a third-party system, the program code comprising instructions which, when executed by a processor, cause the processor to perform operations including:

receiving, by a data provider service with an application program interface (“API”) and from the third-party system, an authentication API call addressed to an authentication endpoint of the data provider API, the authentication API call identifying a user identifier of a user;

determining, from the user identifier included in the authentication API call, that the user is authorized to access one or more features of the data provider service;

transmitting response information indicating the user identifier to the third-party system;

receiving, by the data provider service and from a user device, a feature API call addressed to a feature endpoint of the data provider API, the feature API call generated by an instance of the web-based application that is controlled by the third-party system, wherein the instance is executed at the user device;

generating, based on the feature API call including the response information and requesting performance of the one or more features, user-specific output data from one or more user data records by performing the one or more features; and

transmitting the user-specific output data to the user device in a format displayable by the instance of the web-based application.

16. The non-transitory computer-readable medium of claim 15 , the operations further including generating the user identifier by performing, prior to a receipt of the authentication API call, additional operations comprising:

receiving, from the third-party system, an enrollment API call addressed to an enrollment endpoint of the data provider API, the enrollment API call requesting that the user be authorized to access the data provider service;

verifying an identity of the user based on (i) authentication data included in the enrollment API call and (ii) information about the user from the user data records;

generating the user identifier; and

transmitting the user identifier to the third-party system.

17. The non-transitory computer-readable medium of claim 15 , the operations further including:

generating an access token that includes the response information, wherein transmitting the response information includes transmitting the access token to the third-party system;

determining that the feature API call includes the access token;

verifying that the access token included in the feature API call has not expired;

determining that the access token included in the feature API call is associated with the user identifier; and

verifying that the user identifier is associated with an authorization for the one or more features.

18. The non-transitory computer-readable medium of claim 15 , the operations further including:

determining that an additional user identifier included in an additional authentication API call does not match any user data record; and

responsive to determining that the additional user identifier does not match any user data record, transmitting, to the third-party system, an error indicating a failure to authenticate an additional user associated with the additional user identifier.

19. The non-transitory computer-readable medium of claim 15 , wherein determining that the user is authorized to access one or more features of the data provider service includes:

determining a requested feature included in the authentication API call; and

determining that the requested feature is in a set of enrolled features associated with the user identifier.

20. The non-transitory computer-readable medium of claim 15 , wherein generating the user-specific output data is responsive to determining that the one or more features are within an operation scope associated with the response information.