[phowells]

Summary

• migrate the authoritative SDX Data Access Protocol into Connected Services TechDocs
• document the implemented client and internal Edge-to-Edge header behavior
• define the intended provider-facing headers and response correlation behavior
• add the page to the Secure Data Exchange navigation

Documentation corrections

• retain X-Client-Id as the client connection selector and as an internal Edge-to-Edge routing header
• retain internal X-Service-Id, authoritative X-SDX-Client-Subsystem-Id, conditional X-SDX-Original-AZP, Authorization, Content-Digest, and Correlation-Id
• remove X-Client-Id, X-Service-Id, and X-Edge-Token from the supported provider-facing contract
• add Correlation-Id to both response paths
• remove the provider-facing X-Client-Id compatibility promise

Implementation follow-up

No runtime implementation is changed by this PR. The current Service Edge still forwards X-Client-Id, X-Service-Id, and X-Edge-Token to providers. X-Edge-Token authenticates the Edge-to-Edge hop and is not a supported provider proof that a request came through SDX.

Follow-up implementation work should strip the internal headers after routing and trust verification, add provider-boundary regression tests, and define a separate provider-verifiable assertion if required. This aligns with the managed-header contract work in APS-5004.

Validation

• mkdocs build --strict --site-dir /tmp/aps-5051-secure-data-exchange-site
• git diff --check

Issue

APS-5051

[phowells]

Closing because the SDX Data Access Protocol must be updated in place in bcgov/aps-infra-platform. No changes from this draft were merged.