Denmark’s CPR breach: Securing third-party access to your API

About 14 million lookups pulled 8.8 million records from Denmark's civil register through one company's lawful access, and every one of them authenticated. How to model third-party access in your own API so population, volume and purpose get checked too.