API Overview
Introduction
Core, as a headless RESTful API PHP application, underpins various in-production digital solutions, offering flexible and scalable content management alongside client-specific capabilities.
While this documentation can be read on its own, to understand the full capabilities and features of Core, it is often supplemented with specific sub-specifications for frontend applications, for example Core Starter Functional Specification. Sub-specifications detail the application of Core's backend functionalities in various frontend contexts, providing a more complete picture of how Core's capabilities are leveraged in specific digital solutions.
This overview aims to delineate Core's functionalities, architectural design, and its role in enabling Gallagher Communication digital services.
Headless Architecture and Frontend Flexibility
Central to Core is its headless architecture, which delivers a backend system decoupled from any frontend or administrative user interface. This separation ensures versatility in integrating with various disparate technologies. While Angular is frequently used and our current technology standard for frontend development, Core's agnostic nature allows compatibility with many other programming frameworks, in broad support of diverse project requirements.
Existing Deployments, Templates, and Audiences
Core's application, in practical scenarios, is multifaceted. It powers US benefits engagement platforms, global employee communication solutions, and UK retirement platforms with complex modellers and calculators. Core is also the foundation for annual and real-time Total Reward Statements, Total Impact Statements, and US Open Enrollment websites and campaigns. Its deployment encompasses brochure-ware solutions, public interfaces, single password-protected, and individual user-authenticated applications. Core can also be deployed as a portal application, seamlessly connecting with external providers, including payroll systems, HRIS, rewards platforms, and authentication services like OKTA.
Productised Approach to Change Control
Core’s development and roadmap is guided by a productised approach to change control. This approach involves an assessment of client needs and requests for bespoke developments. Whenever a new feature or modification is proposed, it is evaluated not just in the context of the individual client's requirements but also for its potential to enhance the overall platform.
This strategic evaluation looks at how a proposed change can be integrated into Core as a standard feature, thereby extending its benefits to existing and new clients. This product-centric mindset ensures that Core continually evolves in a manner that is aligned with the broader market needs and technological advancements. It also allows for a more efficient and scalable development process, as enhancements are not just one-off customisations but are considered as potential permanent improvements to the platform.
System Overview
Platform Basis
Core is built on a RESTful API framework, developed using PHP 8, with Doctrine ORM. This predominantly proprietary foundation provides a powerful and flexible backend system for handling various web-based applications. The headless nature of Core's architecture offers flexibility for the creation of bespoke digital solutions tailored to the specific needs of each client.
Key aspects of the platform include:
Flexible Frontend Integration: While commonly paired with Angular for frontend development, Core's headless nature allows for seamless integration with any frontend technology approved by the Digital Leadership Team.
Robust Backend Services: Core is equipped with a variety of services and features, including granular content management, multilingual support, user authentication mechanisms, and extensible design for tailored digital solutions.
Comprehensive Data Management: Core ensures secure and efficient data handling, with discrete database instances dedicated to client data, for data integrity and security.
Cloud Service Agnosticism: Leveraging Kubernetes and containerisation, although Core is currently maintained in Google Cloud services, it is designed to operate within any cloud service provider, enhancing its adaptability and resilience in a rapidly evolving digital landscape.
This foundation enables Core to support a broad spectrum of digital services, from simple content management systems to complex, data-driven applications; catering to a wide range of business requirements and digital strategies.
Feature Highlights
Granular Content Management: Core's content management system (CMS) is built for granularity, allowing content creators to construct and assign content in blocks universally or to specific user cohorts, using a flexible Access Control List (ACL) mechanism. This granular approach extends to 'Zones', facilitating content distribution across different regions or content versions, for instance, toggling between benefit window periods in US benefits platforms.
Dynamic User Authentication: Core integrates a range of user authentication methods, including SSO identity providers, service providers, and secure individual user authentication. It supports open access web content, as well as restricted access areas, and includes multi-factor authentication using time-based one-time passwords (TOTP), email, and SMS delivery.
Secure Data Management: Beyond robust data processing, Core utilises Cloud MySQL database instances and transitory SFTP services, provisioned for secure and efficient client and provider data transfer.
SAML 2.0 SSO Integration: Core integrates with various SSO providers, accommodating both Gallagher partnerships and client-specific configurations.
Intelligent Search Engine: Powered by ElasticSearch, Core offers an intelligent search experience. It includes dynamic related content blocks and a real-time ACL oriented search index, greatly enhancing content discoverability and relevance.
Core AI Assistant
: A cutting-edge, RAG-based 'Core AI Assistant' is in beta, driven by dynamically vectored content. This feature allows for real-time conversational interactions with content, including granular ACL interpretation.
Communication and Engagement Tools: Core features email campaign management tools with analytics, automated email campaigns based on specific conditions, and integrated notifications for updates and information.
User Account Management: The platform includes security measures like account locking after failed login attempts, optional automated password expiry, and automatic logout features to maintain user account security.
Content Zones and API Integrations: Core's content management system supports multiple countries in a single instance, and can integrate with third-party APIs to deliver richer, personalised content.
Tech-Agnostic Frontend: Alongside its foundation compatibility with Angular, an Ionic-based mobile solution
Core Insights Reports with Guaranteed Data Capture: Core provides in-depth analytics reports, capturing user interaction data at the API level rather than relying on third-party solutions like Google Analytics or client-side data capture methods. This approach ensures comprehensive and accurate analytics, as the data capture is immune to common issues like cookie blockers or user opt-out from tracking mechanisms. These reports deliver valuable insights into frontend website usage, subdivided into user cohorts, and include metrics such as average time on site, email campaign effectiveness, search analytics, and granular page metrics, all compared against previous periods.
Architecture and Infrastructure
The Core platform leverages the power of containerisation using Docker, enhancing consistency across different operational environments and simplifying deployment processes. Regional Kubernetes clusters are employed to deliver production and lesser-environment containers, ensuring efficient scaling, deployment and maintenance.
Core utilises Cloud MySQL database instances for central and tenant data management. Each data-driven client solution is configured with discrete database instances, ensuring data integrity and security.
Compliance with data protection standards, particularly those in the UK and EU, including GDPR, is a cornerstone of the Core design philosophy. The infrastructure's commitment to data residency within the most appropriate region, underscores this focus on security and regulatory compliance. The platform's infrastructure also includes transitory SFTP services for secure data transfers
Core uses task queue processing to ensure the efficiency and integrity of its data pipelines.
System Interoperability
Core's design prioritises seamless interoperability, ensuring it can efficiently integrate and function within diverse digital ecosystems. This interoperability is a key aspect of Core's versatility, enabling it to connect and communicate with a variety of external systems and applications, enhancing the platform's utility and reach.
Integration with Third-Party Systems: Core is engineered to work in tandem with a wide range of external systems, including payroll systems, HRIS platforms, rewards platforms, and authentication services like OKTA.
SSO and Authentication Services: Core supports Single Sign-On (SSO) capabilities, integrating with the SAML 2.0 authentication protocol.
Flexible Data Exchange: Core's infrastructure supports various data exchange formats and protocols, accommodating the needs of different systems it interacts with.
Custom Integration Capabilities: Understanding that each client may have unique integration requirements, Core is designed to be customisable and extensible. This flexibility allows for tailored solutions to be developed, ensuring that specific client needs are met, and their existing systems are seamlessly integrated.
CORS Policies:
Production: Strict CORS policies.
DEV & UAT: IAP policies restrict access.
Functional
These requirements define what Core can accomplish and how it supports various digital solutions.
Authentication and Security
Robust User Authentication: Core supports secure user authentication mechanisms, including SSO with SAML 2.0 integrations, generic password access, and individual user authentication.
Multi-Factor Authentication: The platform incorporates multi-factor authentication methods, such as time-based one-time password (TOTP), email, and SMS-based verification.
Compliance and Data Security: Core adheres to stringent data protection standards, ensuring that all user data is handled securely and in compliance with relevant laws and regulations.
Content Management
Core supports the curation of public and/or protected content.
Granular Content Control: Core delivers a granular content management system, enabling the creation, editing, and assignment of content in blocks to specific user cohorts or universally, governed by a flexible ACL mechanism.
Dynamic Content Distribution: The platform supports the distribution of content across different 'Zones', accommodating regional variations or content versioning.
Data Handling and Integration
Secure Data Transfer: Core ises Cloud MySQL databases for data management and transitory SFTP services for secure data transfer.
API-Driven Data Exchange: The platform’s API-driven approach allows for robust data exchanges and seamless integration with external systems.
Search and Analytics
ElasticSearch Integration: Core integrates ElasticSearch for an intelligent and flexible search experience, including real-time, ACL-oriented indexing.
Insights and Reporting: Core provides comprehensive analytics and insights reports, capturing data at the API level to offer accurate and holistic views of user engagement and platform performance.
Communication Tools
Email Campaign Management: The platform includes tools for delivering, managing and analysing the effectiveness of email campaigns, with features for automated dispatch based on specific conditions.
User Notifications: Integrated notification systems are in place to relay important updates and information to users.
Beta Features and Innovations
Core AI Assistant
Emerging Technologies: Core continuously explores and integrates emerging technologies and beta features to enhance platform capabilities and stay ahead in the digital solutions space.
Content Management and Distribution
Zoning for Targeted Content Delivery: Core's zoning feature allows content to be tailored and distributed based on geographic regions or specific user segments.
Global vs Local Content Prioritisation: The platform can manage global content that can be superseded by localised content, ensuring flexibility and relevance in content delivery.
Non-Functional
Core is designed with a commitment to high operational standards, ensuring its effectiveness as an engine for a wide array of digital solutions. The non-functional requirements include specific SLAs to guarantee system availability, reliability, maintainability, and scalability.
System Availability and Reliability
Core is committed to being operational and accessible around the clock, targeting an uptime of 99.9%. This level of reliability is critical given Core's wide range of applications, from financial incentives management to complex content distribution. The platform is designed to efficiently handle concurrent user loads across multiple regions, ensuring stability during peak times.
Performance Standards
Core maintains high performance standards, with an emphasis on rapid response. The platform is optimised to ensure that loading times for pages, including those with intricate ACL-driven content, do not exceed 2 seconds.
Scalability
Built on a modular architecture, Core is inherently scalable. It is designed to adapt easily to growing user bases and expanding international requirements, including additional languages and localisation needs.
Security Compliance
Core places a strong emphasis on data security, with rigorous encryption protocols for data in transit and at rest. Regular security audits and adherence to data protection regulations like GDPR are integral to the platform's operation, ensuring user data is handled with utmost integrity and confidentiality.
Support and Maintenance
Core's support framework includes regular updates and maintenance to ensure the platform remains current with the latest technological advancements and user requirements. A dedicated service enablement squad provides ongoing assistance and troubleshooting to address internal and client needs.
Data Requirements
Core's delivers a secure, efficient, and compliant environment for handling a wide range of data requirements. The platform's data handling capabilities are designed to meet diverse client needs, ensuring data integrity and privacy.
Data Handling and Processing
Core provides secure and segregated storage for client data using Cloud MySQL database instances. This approach ensures data integrity and confidentiality across different client datasets. Beyond storage, Core incorporates manual and automated procedures for data ingestion and processing. The platform supports automated data pipelines using transitory SFTP services, which can be hosted either by Core or a client provider.
Data Privacy and Compliance
In alignment with international data protection standards, Core is committed to data privacy and regulatory compliance. The platform ensures data residency requirements are met for clients in stringent regulatory environments.
Security Requirements
Core's security framework is designed to protect the platform and its users against a wide range of digital threats, in collaboration with GCIS.
Robust Security Protocols
End-to-End Encryption: Core implements optional end-to-end encryption for sensitive data, to ensure the highest level of security during data transmission.
Google Cloud Armor: Leveraging Google Cloud Armor, Core enhances its defence against web-based attacks, providing additional security layers for data and applications hosted on the platform.
CI-Based Threat Prevention: Continuous Integration (CI) tools are utilised for threat prevention, allowing Core to proactively identify and mitigate security risks in the development pipeline.
Secure Data Storage and Transfer: With Cloud MySQL databases and secure SFTP services, Core ensures the secure storage and transfer of data, bolstered by client-specific data segregation.
Regular Security Audits and Penetration Testing: Core undergoes regular security audits and engages a third-party provider to conduct impartial comprehensive penetration tests. The results of these tests are made available to all clients, ensuring transparency and trust in Core's security measures.
Authentication and Access Control
Multi-Factor Authentication: The platform integrates multi-factor authentication methods, reinforcing user identity verification and access security.
Advanced Access Control Lists (ACLs): Core's ACL system allows granular control over user access to data, aligning access permissions with user authorisation levels.
Privacy by Design
Core is developed with a privacy-by-design philosophy, integrating user data privacy into the platform's architecture and functionality.
Performance Requirements
Core is engineered to meet rigorous performance benchmarks, essential for maintaining seamless user experiences even amidst complex backend operations.
Response Time
Core aims to deliver rapid responses to user interactions, with a target of achieving this within two seconds under normal operational circumstances.
Data Processing Efficiency
Core is optimised for efficient data processing. Regardless of the complexity of the backend calculations, the goal is to display results within two seconds after user input.
Scalability
Core's infrastructure is designed to gracefully handle peak load times, which might occur during significant organisational events or announcements. The platform is structured to support up to 10,000 concurrent users without performance degradation.
Uptime
An uptime of 99.9% is the target, ensuring that the platform is reliably available for users almost anytime.
Content Delivery
Leveraging an integrated secure content delivery network (CDN), Core aims to minimise load times for static resources.
Monitoring and Optimisation
Automated alerts are configured for any deviations from established benchmarks. Regular optimisation, informed by performance data, ensures that Core adapts to evolving usage patterns and scales with organisational growth.
Quality Assurance
Quality assurance within the Core platform is an ongoing, comprehensive process, essential for maintaining high standards of reliability.
The platform undergoes thorough functional testing to confirm that each feature performs as required. Security is prioritised, with regular assessments and third-party penetration tests conducted to safeguard against vulnerabilities. Beyond testing, the approach to quality involves close monitoring of defect density, with a focus on swift issue resolution.
A client services feedback loop integrates user insights into regular platform updates, enhancing both the resolution of immediate issues and the anticipation of potential future challenges. Regular updates and patches not only address security improvements but also introduce new features and refine existing functionalities.
Support
Service Level Agreements (SLAs)
Priority | Description | Details | Digital Acknowledge Within | Behaviour | Typical Resolution Time |
|---|---|---|---|---|---|
Blocker | System Breach | Security compromised. | 1 hour | Escalated immediately. | 2 hours |
Critical | Production Instability | Live environment unavailable, SSL expiry, vulnerability detected. | 1 hour | Escalated with support. | 4 hours |
Major | Key Functional Loss | Issues impacting key campaigns or promotions. | 1 hour | Direct client engagement. | 8 hours |
Minor | Functional Loss | Functionality updates or fixes required. | 4 hours | Discussed in development meeting. | 1 week |
Trivial | Cosmetic Issue | Visual differences or usability issues. | 8 hours | Discussed in development meeting. | 3 weeks |
Escalation Process
Digital Project Manager reviews priority.
If unresolved, escalates to Head of Technology.
Final escalation to Global Experience Director.
Blocker/Critical tickets may be escalated directly.
Support Hours
UK Support Hours: 9-5 office hours.
Out of Hours Support: Currently under review; blocker issues are prioritised immediately.