Regulatory filing data, opened as an API - without opening anything else.

Reject before you inspect.

The cheapest request to handle is the one that never reaches your code. So the architecture spends its first two layers doing nothing but refusing traffic: a global HTTPS load balancer to minimise the attack surface and absorb volumetric attacks, then Cloud Armor enforcing OWASP policies, WAF rules and payload size restrictions. Requests that do not conform to the expected structure are rejected outright - before any authorization logic runs, and long before a Cloud Function is invoked.

A private key, a signed assertion, and a token that expires on its own.

The consumers are machines, so the credential model is built for machines. Each account holds a private key issued by an administrator. To call the API the client signs a JWT with that key, putting its ClientID in the sub claim, and presents it in the authorization header. On success the platform returns a short-lived access token, which the client uses until it expires and then re-signs for another. Nothing long-lived ever travels on a request.

The authentication function is deliberately isolated from the public endpoint: when an invalid token is presented, the failure is contained in the auth path rather than reaching anything behind it.

# exchange a signed assertion for a short-lived token
POST /token
Authorization: Bearer <JWT signed with the account private key>

// the assertion the client signs
{
  "sub": "<ClientID>",
  "aud": "filing-api",
  "iat": 1738252800,
  "exp": 1738253100
}

// what comes back
{
  "access_token": "…",
  "token_type":   "Bearer",
  "expires_in":   900
}

The administrator issues the key and cannot read it back.

Credentials have to be reachable by the code that needs them and unreachable by everyone else - including the people who created them. The scope names that boundary explicitly, and the architecture enforces it in three beats.

The data path and the public path never meet.

The Cloud Functions carrying the discovery logic run inside their own VPC, configured specifically to maintain access isolation. The warehouse is reachable from inside that network and from nowhere else. The public endpoint terminates at the gateway; it has no route onward to the database, which means a compromise at the edge is a compromise of the edge rather than of the corpus behind it.

If it isn't in Terraform, it isn't provisioned.

The whole API infrastructure is provisioned through Terraform. This is the least glamorous decision in the scope and probably the one with the longest tail - five distinct properties follow from it, and every one of them is a thing you cannot retrofit cheaply.

• Automated updates without human intervention. An infrastructure change is an applied definition, not a sequence of console actions someone has to perform correctly.
• Reuse across environments with no extra overhead. The same design instantiates staging, production and anything after them, from one definition rather than three parallel histories.
• Versioned and tracked over time. Every change to the estate has an author, a diff and a date - the same accountability code already has.
• Effective team collaboration. The code is the single source of truth, so "why is this setting like that" has an answer that does not depend on who is still at the company.
• A path to CI/CD. A declared estate is something a pipeline can act on. The scope notes this as future work; the choice that makes it possible is being made now.

One dashboard, three jobs, no read path to a secret.

The React admin dashboard is where access is granted and usage is watched. It does three things, and its restraint about a fourth is what makes decision C hold.