Application platform with flexible permissioning
Systems and methods are provided for an application platform with flexible permissioning. In one embodiment, an application platform with flexible permissioning comprises: a service provider server adapted to interact with an application development server and a client device over a network, the service provider server adapted to implement at least one application programming interface (API); one or more processors; and one or more memories adapted to store machine-readable instructions which when executed by the processors cause the application platform with flexible permissioning to: maintain a profile associated with at least one application developer using the application development server; receive an API call from the application developer; authenticate the application developer and authorize the API call; assign an access level to the application developer based on the profile associated with the application developer; and control permissions given to the application developer to perform operations available based on the assigned access level.
1. A system comprising:
a non-transitory memory; and
one or more hardware processors communicatively coupled to the non-transitory medium and configured to read instructions from the non-transitory memory to cause the system to perform operations comprising:
receiving, from an application of a user device, an application programming interface (API) call associated with an API that is configured to provide access to a plurality of functions of the API, wherein the API call is associated with a transaction request being processed through an application server associated with the application for a user of the user device;
determining an application developer profile associated with the application server, wherein the application developer profile indicates a particular access level of a plurality of access levels configured to control access to different ones of the plurality of functions of the API; and
processing the API call for the user according to the particular access level.
2. The system of claim 1 , wherein the determining the application developer profile comprises:
accessing a plurality of transactions processed through the application server based on one or more API calls to the system; and
determining transaction characteristics of the plurality of transactions, wherein the application developer profile is determined based at least in part on the transaction characteristics.
3. The system of claim 2 , wherein the application developer profile is determined further based on a comparison between the transaction characteristics of the plurality of transactions and characteristics of the transaction request.
4. The system of claim 1 , wherein the application is one of a mobile application or a website.
5. The system of claim 1 , wherein the API call specifies a particular function of the plurality of functions, and wherein the operations further comprise:
determining whether the particular function is accessible by the application based on the particular access level.
6. The system of claim 5 , wherein the operations further comprise:
determining that the particular function is accessible by the application based on the particular access level, wherein the processing the API call comprises performing the particular function for the transaction request.
7. The system of claim 5 , wherein the operations further comprise:
determining that the particular function is inaccessible by the application based on the particular access level, wherein the processing the API call comprises denying the transaction request.
8. A method, comprising:
receiving, by a computer system and from an application of a user device, an application programming interface (API) call associated with an API that is configured to provide access to a plurality of functions of the API, wherein the API call is associated with a transaction request being processed through an application server associated with the application for a user of the user device;
obtaining, by the computer system, an application developer profile associated with the application server, wherein the application developer profile indicates a particular access level of a plurality of access levels configured to control access to different ones of the plurality of functions of the API; and
processing, by the computer system, the API call for the user according to the particular access level.
9. The method of claim 8 , wherein the transaction request is associated with a payment transaction.
10. The method of claim 8 , further comprising:
determining the application developer profile based on one or more characteristics associated with the application server.
11. The method of claim 10 , wherein the API call specifies a plurality of parameters for a payment transaction, and wherein the determining the application developer profile comprises comparing one or more parameters from the plurality of parameters against parameters associated with one or more transactions previously processed through the application server.
12. The method of claim 10 , wherein the application server profile is determined based at least in part on a location associated with the user device.
13. The method of claim 8 , wherein the API call comprises credential data associated with the application server, wherein the method further comprises:
authenticating the application based on the credential data; and
determining an identity of an application developer that developed the application based on the credential data.
14. The method of claim 13 , wherein the application developer profile is obtained further based on the identity of the application developer.
15. A non-transitory machine-readable medium having stored thereon machine-readable instructions executable to cause a machine to perform operations comprising:
receiving, from an application of a user device, an application programming interface (API) call associated with an API that enables access to one or more functions of the API, wherein the API call is associated with a request being processed through an application server associated with the application for a user of the user device;
determining an application developer profile associated with the application server, wherein the application developer profile indicates a particular access level of a plurality of access levels configured to control access to the one or more functions of the API; and
processing the API call for the user according to the particular access level.
16. The non-transitory machine-readable medium of claim 15 , wherein the determining the application developer profile comprises:
accessing a plurality of transactions processed through the application server based on one or more API calls to the system; and
determining transaction characteristics of the plurality of transactions, wherein the application developer profile is determined based at least in part on the transaction characteristics.
17. The non-transitory machine-readable medium of claim 16 , wherein the application developer profile is determined further based on a comparison between the transaction characteristics of the plurality of transactions and characteristics of the transaction request.
18. The non-transitory machine-readable medium of claim 15 , wherein the application is one of a mobile application or a web site.
19. The non-transitory machine-readable medium of claim 15 , wherein the API call specifies a particular function of the one or more functions, and wherein the operations further comprise:
determining whether the particular function is accessible by the application based on the particular access level.
20. The non-transitory machine-readable medium of claim 19 , wherein the operations further comprising:
determining that the particular function is accessible by the application based on the particular access level, wherein the processing the API call comprises performing the particular function for the transaction request.