Varyos Platform - API-first backend with workflow-backed endpoints
For developers and architects

Varyos Platform - API-first backend with real workflow power

Build custom frontends, mobile apps and PWAs in your preferred stack while we handle tenancy, workflows, security, scale and the operational core.

The platform is workflow-backed, not raw CRUD. Every endpoint executes the same business rules and audit logic that the core Varyos product relies on - so a partner UI can never bypass operational invariants.

Open API endpoint
Secured via APIM Entra ID identity Azure-native scale
POST /v1/bookings
POST /v1/forms/submissions
POST /v1/inbox/items
GET /v1/availability
PWA / mobile
APIM + JWT
Workflow core
Capabilities

What the platform takes off your plate

A compact but production-grade backend so you can focus on the surface that actually differentiates your vertical product.

Multi-tenancy and isolation

Strict tenant boundaries enforced at API, workflow and storage level - safe for white-label deployments.

Workflow-backed APIs

Every endpoint runs through the workflow engine - no raw CRUD shortcuts that bypass business rules.

Booking and scheduling engine

Availability, reschedules, cancellations and customer-linked appointments out of the box.

Forms and inbox workflows

Public or authenticated forms feeding structured submissions into the operational inbox.

CRM, DMS, billing, subscriptions

Customer records, documents, invoicing and entitlements - all accessible through the same secure API.

Azure infrastructure plus APIM

Hosted on a scalable Azure stack, fronted by API Management, WAF and Front Door.

Security architecture

Secure mobile and PWA integration with APIM and Entra ID

The honest answer up front: you cannot truly lock a browser PWA down by origin alone - anything in the bundle can be replicated. The real security boundary therefore has to live at the token layer.

Recommended baseline

Identity provider: Microsoft Entra ID

  • Two app registrations: one for the API ("Varyos Mobile API"), one for the PWA ("Varyos Mobile PWA")
  • Scope: api://<api-app-id>/Mobile.Access
  • PWA uses MSAL.js with Authorization Code Flow + PKCE - no client secret in the browser
  • Tokens are sent as bearer tokens to APIM
APIM enforcement

The real security boundary

APIM validates every request before it reaches the workflow core. Mobile operations live in a dedicated APIM product so policies, rate limits and quotas can differ from the public surface.

<validate-jwt header-name="Authorization" require-scheme="Bearer">
  <openid-config url="https://login.microsoftonline.com/<tenant>/v2.0/.well-known/openid-configuration" />
  <required-claims>
    <claim name="aud"><value>api://<api-app-id></value></claim>
    <claim name="scp" match="any"><value>Mobile.Access</value></claim>
  </required-claims>
</validate-jwt>
Defence in depth

Additional security layers, on top of token validation

JWT validation is the load-bearing wall, but production deployments stack additional protections that your enterprise customers will expect.

Network and traffic

Azure Front Door plus WAF in front of APIM, CORS limited to your domains, rate limiting per token, IP and subscription.

Identity and device

Conditional Access policies for MFA, device compliance and location, plus per-tenant audit logs and token revocation hooks.

Get hands on

Next steps for developers

01

Create Entra ID app registrations

Register the API and the client app, define the scope and grant admin consent in your tenant.

02

Wire MSAL.js into the PWA

Use Authorization Code Flow with PKCE, request the platform scope and attach bearer tokens to fetch calls.

03

Split APIM products and apply policies

Group operations into Mobile, Partner and Public products, attach the JWT validation policy and quotas.

04

Try the docs and reference frontend

Open the live API endpoint and the reference frontend to see a vertical UI talking to the platform.

Ready to integrate?

Open the endpoint or talk to engineering

https://api.varyos.app is the technical endpoint. platform.vamedari.de is the partner landing surface. Both reference the same workflow-backed core.

Open API reference
Leider ist ein Fehler aufgetreten. Laden Sie die Seite neu. 2026.09.18 Neu laden 🗙