USCIS API Use Policy

Purpose

DocPrep uses USCIS APIs only for authorized application functions, including retrieving case status by receipt number when a user requests that status check.

Backend-Only Architecture

USCIS client credentials, client secrets, and access tokens are stored only in backend environment variables or approved secret storage. They are not published in frontend JavaScript, sent to browsers, or stored in public repositories.

OAuth and Request Flow

DocPrep uses OAuth 2.0 Client Credentials flow to obtain access tokens. The approved flow is: user interface -> DocPrep backend -> USCIS OAuth/API -> DocPrep backend -> user interface.

Direct browser requests from users to USCIS APIs are prohibited.

Demo Traffic and Monitoring

Before requesting production access, DocPrep tests the sandbox integration for at least five consecutive calendar days, including successful 200 responses and 4xx error responses.

If USCIS provides a demo_id, DocPrep adds it to request headers according to USCIS instructions for demo and monitoring.

Logging

DocPrep may log technical API request metadata for debugging, audit, security, and demo validation.

• timestamp, endpoint, and environment;
• HTTP status code and USCIS error code/message, if provided;
• traceId or reference, if USCIS returns one;
• internal response handling result.

What Is Not Logged

DocPrep must not log USCIS client secrets, access tokens, refresh tokens, or other secrets. Production credential access is limited to authorized team members only.

Error Handling

The system must handle documented HTTPS responses from USCIS APIs. The user interface displays a clear message, while backend logs may retain technical details for troubleshooting.

Rate Limits and Fair Use

DocPrep respects USCIS sandbox and production rate limits. Automated checks must be controlled to avoid unnecessary traffic, repeated failed calls, or excessive polling.

Credential Rotation and Incident Response

USCIS API credentials are rotated according to USCIS requirements or immediately if compromise is suspected. During an incident, DocPrep revokes or rotates credentials, removes exposed secrets from code or logs, reviews access history, and notifies USCIS support if required.