---
title: SAIF.Framework.Security.EnvironmentApi overview
summary: High-level purpose, scope, and responsibilities for this library.
status: draft
owner: <owner>
last_reviewed: 2026-07-23
library: SAIF.Framework.Security.EnvironmentApi
reference_type: package
---

# SAIF.Framework.Security.EnvironmentApi overview

> **Documentation context:** Packaged Component (NuGet)

`SAIF.Framework.Security.EnvironmentApi` is the Environment API client layer of the SAIF Security framework. It resolves runtime environment/configuration context for consuming applications through a central Environment API HTTP service, and provides AD-group-based machine/service-account authorization together with a thin WCF client to the centralized `SecurityService` endpoint.

## Purpose
- Resolve runtime environment context (host, track, deployment tier, client type) and retrieve configuration settings from a central Environment API HTTP service via `IEnvironmentService` and its host-specific implementations.
- Provide AD-group-based machine/service-account authorization (`MachineSecurityService`/`ADService`), including developer-machine detection.
- Provide a thin WCF client (`SecurityServiceClient`) to the centralized `SecurityService` endpoint as an alternative to the local/direct AD authorization path.
- Support secure configuration retrieval through salted system-hash generation and validation (`SystemHashUtil`).

## Responsibilities
- Cache configuration settings in memory and refresh them on a throttled interval (`AllowRefreshCheckInSeconds`, default 120s).
- Surface host-specific environment details (application host, machine name, client-external/inside-firewall status, local-machine status, current principal) for five distinct hosting contexts: web, Windows/console, WCF, custom, and Office Add-in.
- Authorize machine/service accounts against AD groups, distinguishing production vs. non-production resource-name conventions.
- Enforce that a required OS environment variable (`EnvironmentApiUrl`) is present before any environment-dependent operation executes.

## Key components
- `IEnvironmentService`: primary contract for environment/config/user-context access.
- `EnvironmentServiceBase`: abstract base class implementing `IEnvironmentService`, performing HTTP calls, caching, and hosting the developer-machine authorization logic.
- `WebEnvironmentService`, `WindowsEnvironmentService`, `WcfEnvironmentService`, `CustomEnvironmentService`, `OfficeAddinEnvironmentService`: host-specific concrete implementations of `EnvironmentServiceBase`.
- `MachineSecurityService`/`ADService`: local AD group-membership authorization primitive for machine/service accounts.
- `SecurityServiceClient`: thin WCF client wrapper to the centralized `SecurityService` endpoint.
- `SystemHashUtil`: salted system-hash generation/validation supporting secure configuration retrieval.

## Related documentation
- [Index](index.md)
- [Architecture](architecture.md)
- [Dependencies](dependencies.md)
- [Operations and processes](operations-processes.md)
- [Business rules](business-rules.md)
- [Configuration](configuration.md)
- [Security and authorization](security-authorization.md)
- [API reference](api/index.md)

## Sources
- SAIF.Framework.Security.EnvironmentApi\SAIF.BOF.Framework.Security.EnvironmentApi.csproj
- SAIF.Framework.Security.EnvironmentApi\Core\Services\IEnvironmentService.cs
- SAIF.Framework.Security.EnvironmentApi\Services.Common\EnvironmentServiceBase.cs