Registering an Application

An application is the identity AI Data Shield authenticates on every call. Registering one gives your workload a signing key and the collections it may classify against. Nothing is accepted until the caller holds a registered identity.

An application is not a data source: no database connection, no service user, no repository. It is your own code, calling ALTR from wherever it runs.

Prerequisites

• At least one collection whose classifiers can match free text. A collection is rejected if none of them can – see API Payload Classification.
• Somewhere to store a private key your application can read at run time.

Register an Application

To register an application:

1. Select Data Configuration > Applications in the navigation menu. ALTR opens the list of Shield applications.
2. Confirm the application type selector reads Shield SDK.
3. Click Register Application. ALTR opens the New Shield Application drawer.
4. Enter an Application name.
5. Enter a Description naming the workload that uses this identity.
6. Under Application Configuration, select the collections this application may classify against in Allowed collections. Leaving the field empty allows any collection in your organization.
7. Under Tags, add any tags that describe the application itself. Shield policy rules can match these – see Shield Policy.
8. Under Key Pair, choose Generate a key pair for me to have ALTRNet generate the pair in your browser, or Paste a public key to register a key you already hold and enter it in Public key (PEM). A pasted key must be RSA, 2048 bits or larger.
9. Click Create Application. ALTR registers the application and assigns it an identifier you cannot choose or change.

Caution

If you chose Generate a key pair for me, ALTR displays the private key once, in a dialog titled Download Your Private Key, and never again. Click Download Private Key before you close the dialog. ALTR does not store the private key and cannot reissue it – losing it means rotating the key.

Credentials Your Application Needs

The AI Data Shield software development kit (SDK) needs 5 values, set when your application constructs its client (the collection can also be set per call):

• The application identifier ALTR generated at registration.
• Your ALTR Organization ID, from the application’s details drawer or Settings > Preferences.
• The private key matching the public key you registered.
• The Shield Base URL on the application’s details drawer – the Data Plane URL issued for your organization.
• The collection the application classifies against, from its allowed list.

The application identifier, the allowed collections, and the Shield Base URL are all on the application’s details drawer in ALTRNet. The private key is the one you downloaded or already held – ALTR never has it.

Allowed Collections

Allowed collections is a hard limit, not a default. Shield rejects a protect call whose collection falls outside the application’s list. Leaving the list empty permits any collection in your organization.

ALTR validates each collection as you add it. A collection that does not exist is rejected, and so is one whose classifiers could never match free text – at least one classifier must carry a Regex Pattern Match, Google DLP, or Amazon Comprehend condition that is not negated.

The collection list is the only limit registration places on an application. What it may restore is decided entirely by Shield policy.

Caution

Detokenization rules that never look at the minting application apply to every application in your organization alike – any of them can restore any token another one minted. If your applications must not read each other’s values, author that rule before the second application mints anything – Shield Policy provides a ready-made rule that limits each application to the tokens it protected itself.

Tags on an Application

Tags on an application describe the workload, not the data. Shield policy rules match them in their request conditions, so a rule can allow or deny by what a caller is rather than by naming each application.

Keys and values are lowercase, begin with a letter or numeral, and may contain letters, numerals, _, -, and .. Each segment is 1 to 32 bytes, key and value together at most 65. An application carries at most 16 tags. Keys cannot begin with altr – ALTR reserves that prefix for the values it stamps itself.

The same grammar and the same 16-tag limit apply to the tags a protect or restore call sends.

Rotate an Application Key

An application holds up to 2 registered public keys, so a new key can be in place before the old one retires. ALTR picks the slot: whichever is free, or the older of the two when both are in use. Calls signed with the remaining key keep working throughout.

Key Slots shows the current state as Slot 1 and Slot 2 chips, on both the Applications list and the details drawer. An unused slot reads Empty; a registered one shows a shortened fingerprint.

To rotate an application’s key:

1. Select Data Configuration > Applications in the navigation menu.
2. Click the application to open its details.
3. Click Rotate Key. ALTR opens a dialog titled Rotate Key followed by the application’s name.
4. Choose Generate a key pair for me or Paste a public key.
5. Click Rotate Key. ALTR reports which slot it wrote.

Caution

Rotating with Generate a key pair for me displays the new private key once, in a dialog titled Download Your New Private Key. Click Download Private Key before closing it – as at registration, ALTR does not store it and cannot reissue it.

A rotation takes up to 5 minutes to affect a call presenting a credential ALTR has already accepted, which is how long an accepted credential is cached. A newly signed call picks up the change immediately.