The HTTP API is functional but not hardened for production. We need authentication, consistent error/limit handling, stronger timeouts/resource caps, better observability, and more robust LOB support.
- AuthN/AuthZ: Add API keys/JWT/mTLS and namespace/role-based ACLs; return 401/403 consistently.
- Error Model: Standard JSON error schema with codes; consistent status codes.
- Observability
- LOB Handling: configurable max LOB size, Chunked streaming with size hints (Clients send a Content-Length or metadata up front).
- Timeouts & Lifecycle: per-request contexts with deadlines; enforce idle/max txn lifetime using configuration
The HTTP API is functional but not hardened for production. We need authentication, consistent error/limit handling, stronger timeouts/resource caps, better observability, and more robust LOB support.