Integration model
Frame Analytics systems exchange typed JSON events over authenticated messaging and HTTPS interfaces. Routes identify a bounded destination; payloads identify a schema and operation; neither is invented by a public browser client.
Illustrative command envelope
{
"schema": "frame.command.request.v1",
"command_id": "2ec750b5-…",
"controller_id": "Controller 7",
"operation": "pump.set_state",
"arguments": {"state": "off"},
"created_at": "2026-08-13T10:00:00Z",
"expires_at": "2026-08-13T10:00:15Z"
}This example describes the shape, not a public endpoint or permission to copy production identifiers. Customer schemas and routes are versioned with the deployment.
Messaging rules
- Use a schema version and stable operation name.
- Assign a globally unique command or event ID.
- Route to one intended Controller or explicit group.
- Expire commands that are no longer safe or relevant.
- Validate bounded arguments against Controller capabilities and current state.
- Make retries idempotent and reject replayed physical commands.
- Publish status and result events separately from transport acknowledgements.
- Carry correlation and causation IDs through logs and downstream events.
Delivery semantics
Durable queues and persistent messages reduce loss; they do not magically produce exactly-once physical actuation. Consumers assume duplicates are possible. A Controller journals command IDs before execution and treats a repeated ID as the same request.
Credential boundaries
Website publisher
Write permission only to the public demo destination. No consumption, administration, or arbitrary routing.
Controller consumer
Read permission only for its assigned route plus narrowly scoped result publishing.
Platform services
Separate service identities for API, dispatcher, event worker, scheduler, and operators.
Human access
Administrative credentials are not application credentials and do not belong in source, images, browser code, or support screenshots.
HTTPS and webhooks
External integrations authenticate requests, verify signatures, limit body size, reject replays, use explicit timeouts, and retain correlation IDs. A successful HTTP response represents a defined state such as accepted, not a vague implication that physical work completed.
Configuration and secrets
Broker URLs, SMTP credentials, signing keys, and private certificates are injected at runtime. They are not copied into the Docker image or committed to the repository. File paths may point to read-only bind mounts under /etc/frame.