rumahl Developers Portal

The rumahl Developers Portal is the central control center for developers, software studios, and enterprises delivering applications, extensions, or cloud services to the rumahl ecosystem. Here you manage organizations, register apps, configure OAuth clients, monitor releases, and review analytics.

Overview: The Developer Portal

The Developer Portal is accessible through a web console and programmatically via the Developer REST API.

Organizations & Team Roles

Projects inside rumahl Developers are structured around Organizations. An organization groups apps, API keys, webhooks, and billing settings for an engineering team.

Role Matrix

Team Management & Audit Log

Every critical operation (e.g. role updates, secret generation, store releases) is recorded immutably in the organization's Audit Log:

• Timestamp and IP address of the actor

• Executed action (e.g. api_key.create, release.rollout_started)

• Target object and outcome

Registering Apps & Products

Every application in the rumahl ecosystem requires a registered record in the Developer Portal.

1. 1Navigate to Apps & Products in the portal.

1. 1Click Create New App and provide a unique reverse-domain identifier (e.g. com.example.smarthome).

1. 1Select the app architecture:

• Containerized App: Standalone Docker container managed by rumahl-supervisor.

• Sandbox Plugin: Lightweight plugin for the JavaScript/TypeScript runtime sandbox.

• Cloud Service: External web service integrated with rumahl APIs.

1. 1Once created, you immediately receive:

• Client ID: Public identifier for OAuth flows.

• Client Secret: Confidential key for server-to-server calls.

• Redirect URIs: Allowed callback URLs (HTTPS or custom schemes like rumahl-app://callback).

Manifest & Permissions

In the Permissions tab, declare all required system scopes:

{
  "app_id": "com.example.smarthome",
  "name": "SmartHome Pro",
  "version": "1.2.0",
  "requested_scopes": [
    "rumahl.devices.read",
    "rumahl.devices.control",
    "rumahl.notifications.send"
  ],
  "oauth": {
    "redirect_uris": [
      "https://smarthome.example.com/api/auth/callback"
    ]
  }
}

App Review & Verification

Apps intended for distribution in the public rumahl App Store undergo a structured verification pipeline.

Review Pipeline

1. 1Automated Validation:

• Schema and manifest syntax verification

• Static security analysis (vulnerable dependencies, hardcoded secrets)

• Runtime sandbox constraint checks

1. 1Manual Security & Policy Review:

• Privacy policy and data minimization compliance

• Functional verification of requested permission scopes

• Completeness of imprint, legal notices, and support channels

1. 1Status Workflow:

• draft: App under construction

• in_review: Currently being tested by the rumahl security team

• approved: Approved for public Store availability

• rejected: Action needed (detailed feedback provided in dashboard)

Release Channels & Phased Rollouts

rumahl provides multi-stage release channels to deliver updates with minimal operational risk.

Phased Rollouts

For production releases, you can gradually distribute binaries:

• 10%: Early canary stage monitoring crash and error telemetry

• 25% & 50%: Broader distribution across diverse hardware profiles

• 100%: General availability across all installations

If unexpected anomalies or crashes are detected during rollout, the release can be halted instantly via UI or REST call (POST/releases/:id/halt).

Developer Security Guidelines

All developers registered on the platform must adhere to fundamental security standards:

• Mandatory 2FA / Passkeys: Required on all accounts with write or publication permissions.

• Client Secret Protection: Client secrets must never be embedded in client-side code (mobile apps, SPAs). Use PKCE instead.

• Scheduled Secret Rotation: Rotate API keys and secrets at least every 180 days. The portal provides zero-downtime dual-key rotation windows.