Ownership and runbook
Owner: Incident Response. Runbook: RB-API-SECURITY-OPS-001. On suspected compromise, revoke first, then investigate, then restore through the normal approval path.
Developer preview API v1
Sandbox only. No real funds moved. No production access is granted here. Access requirements
Incident response
Revoke first, then investigate and restore
A suspected compromise stops value movement immediately and restores access only through a fresh approval record.
Containment order
Revoke the affected credential and webhook endpoint whe_01900000000000000000000000, quarantine affected records, and freeze further value movement until reconciliation completes.
Prohibited
Never continue transacting on a suspected compromised key while investigating, and never restore access without a fresh approval record and a completed root-cause review.