OVERALL CONTROL / 0.6-customer-control
Grades and scoring
Data access
25% of the overall score before applicability adjustment.
Scored answers and evidence
Read interface 7.5/10
Structured API for the declared product scope
CMiC published Opportunity Management organization reads and customer service-account API security; deployment/patch-specific OAuth migration and partner integrations are separate checks.
Endpoint returns structured OM-only organization records.
CMiC Retrieve Organization reference ↗
Overview · Checked 2026-10-16
Bulk delivery 8.8/10
Batched or iterable API requests
CMiC published Opportunity Management organization reads and customer service-account API security; deployment/patch-specific OAuth migration and partner integrations are separate checks.
Organization collection documents limit/offset iteration.
CMiC Retrieve Organization reference ↗
Query Standards / limit / offset · Checked 2026-10-16
Query expressiveness 8.8/10
Documented structured API filters
CMiC published Opportunity Management organization reads and customer service-account API security; deployment/patch-specific OAuth migration and partner integrations are separate checks.
SelectByOrgCode finder and AND-combined finder parameters documented.
CMiC Retrieve Organization reference ↗
Finders / Query Standards · Checked 2026-10-16
Access cost barrier -
-
CMiC published Opportunity Management organization reads and customer service-account API security; deployment/patch-specific OAuth migration and partner integrations are separate checks.
The reviewed CMiC route does not establish access cost barrier.
CMiC Retrieve Organization reference ↗
Reviewed route documentation; applicable scoring contract not established · Checked 2026-10-16
Third-party accessibility
20% of the overall score before applicability adjustment.
Scored answers and evidence
Third-party eligibility -
-
CMiC published Opportunity Management organization reads and customer service-account API security; deployment/patch-specific OAuth migration and partner integrations are separate checks.
Customer service-account setup and partner contact route do not establish arbitrary third-party eligibility.
CMiC service-account creation ↗
Reviewed route documentation; applicable scoring contract not established · Checked 2026-10-16
Downstream permission -
-
CMiC published Opportunity Management organization reads and customer service-account API security; deployment/patch-specific OAuth migration and partner integrations are separate checks.
The reviewed CMiC route does not establish downstream permission.
CMiC Retrieve Organization reference ↗
Reviewed route documentation; applicable scoring contract not established · Checked 2026-10-16
External action
15% of the overall score before applicability adjustment.
Scored answers and evidence
Write interface -
-
CMiC published Opportunity Management organization reads and customer service-account API security; deployment/patch-specific OAuth migration and partner integrations are separate checks.
The reviewed CMiC route does not establish write interface.
CMiC Retrieve Organization reference ↗
Reviewed route documentation; applicable scoring contract not established · Checked 2026-10-16
Custom application path -
-
CMiC published Opportunity Management organization reads and customer service-account API security; deployment/patch-specific OAuth migration and partner integrations are separate checks.
The reviewed CMiC route does not establish custom application path.
CMiC Retrieve Organization reference ↗
Reviewed route documentation; applicable scoring contract not established · Checked 2026-10-16
Continuity
15% of the overall score before applicability adjustment.
Scored answers and evidence
Refresh mechanism -
-
CMiC published Opportunity Management organization reads and customer service-account API security; deployment/patch-specific OAuth migration and partner integrations are separate checks.
Returned update timestamps do not establish a supported updated-since filter.
CMiC Retrieve Organization reference ↗
Reviewed route documentation; applicable scoring contract not established · Checked 2026-10-16
Limit visibility -
-
CMiC published Opportunity Management organization reads and customer service-account API security; deployment/patch-specific OAuth migration and partner integrations are separate checks.
The reviewed CMiC route does not establish limit visibility.
CMiC Retrieve Organization reference ↗
Reviewed route documentation; applicable scoring contract not established · Checked 2026-10-16
CDC and deletion capture -
-
CMiC published Opportunity Management organization reads and customer service-account API security; deployment/patch-specific OAuth migration and partner integrations are separate checks.
Inactive flags and update timestamps do not establish deletion identity capture.
CMiC Retrieve Organization reference ↗
Reviewed route documentation; applicable scoring contract not established · Checked 2026-10-16
Replay and gap recovery 2.5/10
Rebuild from a fresh snapshot; no historical replay established
CMiC published Opportunity Management organization reads and customer service-account API security; deployment/patch-specific OAuth migration and partner integrations are separate checks.
Re-enumerate current records to rebuild the disclosed scope; historical event replay, deletion recovery and full history are unverified.
CMiC Retrieve Organization reference ↗
Query Standards / limit and offset · Checked 2026-10-16
Data exit
20% of the overall score before applicability adjustment.
Scored answers and evidence
Export custody 7.5/10
Customer-held structured files or API records
CMiC published Opportunity Management organization reads and customer service-account API security; deployment/patch-specific OAuth migration and partner integrations are separate checks.
Authorized organization responses are structured external records.
CMiC Retrieve Organization reference ↗
200 response / Attributes · Checked 2026-10-16
Post-cancellation access Disclosure
-
Disclosure only; does not reduce planned-exit credit.
CMiC published Opportunity Management organization reads and customer service-account API security; deployment/patch-specific OAuth migration and partner integrations are separate checks.
The reviewed CMiC route does not establish post-cancellation access.
CMiC Retrieve Organization reference ↗
Reviewed route documentation; applicable scoring contract not established · Checked 2026-10-16
Planned migration fidelity 7.5/10
Portable structured records on documented routes; whole-product completeness unverified
CMiC published Opportunity Management organization reads and customer service-account API security; deployment/patch-specific OAuth migration and partner integrations are separate checks.
Portable scoped organizations; whole-product files/history unverified.
CMiC Retrieve Organization reference ↗
Overview / Attributes · Checked 2026-10-16
Business logic and customization
5% of the overall score before applicability adjustment.
Scored answers and evidence
Logic authoring 2.5/10
External integration code; native business logic portability not established
CMiC published Opportunity Management organization reads and customer service-account API security; deployment/patch-specific OAuth migration and partner integrations are separate checks.
Dedicated accounts serve machine-to-machine applications and integrations.
CMiC service-account creation ↗
Why Use an API Service Account? · Checked 2026-10-16
Rights to custom logic -
-
CMiC published Opportunity Management organization reads and customer service-account API security; deployment/patch-specific OAuth migration and partner integrations are separate checks.
The reviewed CMiC route does not establish rights to custom logic.
CMiC Retrieve Organization reference ↗
Reviewed route documentation; applicable scoring contract not established · Checked 2026-10-16
Scores are out of 10. * Incomplete evidence discounts verified capabilities (unknown answers stay unknown). Planned migration drives data exit. Scoring method ↗
CUSTOMER CHOICE
Third-party accessibility
Customers create a dedicated API service account with CMiC application permissions. Basic authentication is documented for the selected endpoint, while newer deployments may use configured OAuth client credentials; partners have a separate contact route.
Confirm who can connect, who owns the credentials and which uses are permitted. Customer consent and provider approval can be separate requirements; the selected plan and contract still matter.
READ / INTEGRATE
API and export routes
The organization endpoint returns OM-only entities, which are distinct from ordinary customer/vendor business partners. Finder, limit and offset parameters support selected collection extraction.
| Access route | Authentication | Credential owner | Provider approval | Access requirement | Last checked |
|---|---|---|---|---|---|
| Customer CMiC API service account | HTTP Basic | Customer | Not confirmed | selected endpoint supports basic; use dedicated permissioned service account; confirm deployment oauth requirements | 2026-10-16 |
Availability depends on your product, plan and agreement. See the documentation below for the requirements of each route.
ECONOMIC ACCESS
Cost, authentication and limits
Minimum API entitlement, fixed charges and numeric throughput quotas remain unresolved. Patch 22 documentation introduces a 1,000-record request limit, which is a response-size boundary rather than a request-rate budget.
Check API entitlement, credential ownership and rate limits for the route you intend to use. Include review fees, customer-plan upgrades and ongoing access charges in the total.
ACT FROM OUTSIDE
External action
The general API catalog does not establish a current write operation in the reviewed organization scope. Verify the specific mutation, module and security rule before relying on writes.
Validate the supported operation, acting identity and permission scope (read access does not imply write permission). Ambiguous retries and revoked credentials also affect whether an external workflow can run safely.
KEEP ACCESS USEFUL
Continuity
Organization records include identity and update timestamps, but the reviewed finder contract does not establish a general updated-since extraction or deletion stream. Repeat snapshots need reconciliation.
CDC, deletions and recovery
| Question | Answer / applicable route | Evidence |
|---|---|---|
| Can ongoing extraction identify updates and deleted records on the declared route? | -CMiC published Opportunity Management organization reads and customer service-account API security; deployment/patch-specific OAuth migration and partner integrations are separate checks. Inactive flags and update timestamps do not establish deletion identity capture. | CMiC Retrieve Organization reference ↗Reviewed route documentation; applicable scoring contract not establishedChecked 2026-10-16 |
| How can extraction recover after missed events or an interrupted consumer? | Rebuild from a fresh snapshot; no historical replay establishedCMiC published Opportunity Management organization reads and customer service-account API security; deployment/patch-specific OAuth migration and partner integrations are separate checks. Re-enumerate current records to rebuild the disclosed scope; historical event replay, deletion recovery and full history are unverified. | CMiC Retrieve Organization reference ↗Query Standards / limit and offsetChecked 2026-10-16 |
Useful ongoing access includes corrections and deletions, not only the first export. A failed request, changed filter or lost resource permission should not be interpreted as a deleted record.
LEAVE WITH YOUR DATA
Data exit and portability
Authorized collection responses can be retained outside CMiC. Full financial history, documents and complete installation recovery remain unverified.
Test the output against the destination’s required fields and history. Check stable identifiers, relationships, attachments and extraction time; a sample file proves only the coverage of that sample.
BUILD / INSPECT / REUSE
Business logic and customization
Service-account applications can implement external rules. Native workflow ownership and independent execution remain unresolved (an inactive organization is not necessarily a deleted record). Cancellation retrieval rights were not established.
Custom API access, ownership of workflows and the right to export their definitions are separate questions. A custom-app capability alone does not establish that business rules can move to another system.
AGREEMENTS / API DOCS / PROGRAM REQUIREMENTS
Documented conditions
Answers below come from public provider materials. Every answer retains its source check date, scope (a partner agreement does not describe every customer route). Customer contracts and live behavior still need verification.
| Question | Answer / applicable route | Evidence |
|---|---|---|
| What structured read interface is documented? | Structured API for the declared product scopeCMiC published Opportunity Management organization reads and customer service-account API security; deployment/patch-specific OAuth migration and partner integrations are separate checks. Endpoint returns structured OM-only organization records. | CMiC Retrieve Organization reference ↗OverviewChecked 2026-10-16 |
| How can customers retrieve data in bulk? | Batched or iterable API requestsCMiC published Opportunity Management organization reads and customer service-account API security; deployment/patch-specific OAuth migration and partner integrations are separate checks. Organization collection documents limit/offset iteration. | CMiC Retrieve Organization reference ↗Query Standards / limit / offsetChecked 2026-10-16 |
| What queries can a customer issue outside the provider UI? | Documented structured API filtersCMiC published Opportunity Management organization reads and customer service-account API security; deployment/patch-specific OAuth migration and partner integrations are separate checks. SelectByOrgCode finder and AND-combined finder parameters documented. | CMiC Retrieve Organization reference ↗Finders / Query StandardsChecked 2026-10-16 |
| Who decides whether a chosen third party may connect? | -CMiC published Opportunity Management organization reads and customer service-account API security; deployment/patch-specific OAuth migration and partner integrations are separate checks. Customer service-account setup and partner contact route do not establish arbitrary third-party eligibility. | CMiC service-account creation ↗Reviewed route documentation; applicable scoring contract not establishedChecked 2026-10-16 |
| What extra commercial condition applies to the routes supplying the assessed read capability, relative to the lowest paid plan? | -CMiC published Opportunity Management organization reads and customer service-account API security; deployment/patch-specific OAuth migration and partner integrations are separate checks. The reviewed CMiC route does not establish access cost barrier. | CMiC Retrieve Organization reference ↗Reviewed route documentation; applicable scoring contract not establishedChecked 2026-10-16 |
| What permission is needed for the documented downstream use? | -CMiC published Opportunity Management organization reads and customer service-account API security; deployment/patch-specific OAuth migration and partner integrations are separate checks. The reviewed CMiC route does not establish downstream permission. | CMiC Retrieve Organization reference ↗Reviewed route documentation; applicable scoring contract not establishedChecked 2026-10-16 |
| Which external write operations are documented? | -CMiC published Opportunity Management organization reads and customer service-account API security; deployment/patch-specific OAuth migration and partner integrations are separate checks. The reviewed CMiC route does not establish write interface. | CMiC Retrieve Organization reference ↗Reviewed route documentation; applicable scoring contract not establishedChecked 2026-10-16 |
| How can customers connect an application they build or choose? | -CMiC published Opportunity Management organization reads and customer service-account API security; deployment/patch-specific OAuth migration and partner integrations are separate checks. The reviewed CMiC route does not establish custom application path. | CMiC Retrieve Organization reference ↗Reviewed route documentation; applicable scoring contract not establishedChecked 2026-10-16 |
| What mechanism supports repeatable extraction of changes? | -CMiC published Opportunity Management organization reads and customer service-account API security; deployment/patch-specific OAuth migration and partner integrations are separate checks. Returned update timestamps do not establish a supported updated-since filter. | CMiC Retrieve Organization reference ↗Reviewed route documentation; applicable scoring contract not establishedChecked 2026-10-16 |
| How are integration limits disclosed? | -CMiC published Opportunity Management organization reads and customer service-account API security; deployment/patch-specific OAuth migration and partner integrations are separate checks. The reviewed CMiC route does not establish limit visibility. | CMiC Retrieve Organization reference ↗Reviewed route documentation; applicable scoring contract not establishedChecked 2026-10-16 |
| Where can a usable data copy be delivered? | Customer-held structured files or API recordsCMiC published Opportunity Management organization reads and customer service-account API security; deployment/patch-specific OAuth migration and partner integrations are separate checks. Authorized organization responses are structured external records. | CMiC Retrieve Organization reference ↗200 response / AttributesChecked 2026-10-16 |
| What retrieval rights are documented at cancellation? | -CMiC published Opportunity Management organization reads and customer service-account API security; deployment/patch-specific OAuth migration and partner integrations are separate checks. The reviewed CMiC route does not establish post-cancellation access. | CMiC Retrieve Organization reference ↗Reviewed route documentation; applicable scoring contract not establishedChecked 2026-10-16 |
| How can customers define their own business logic? | External integration code; native business logic portability not establishedCMiC published Opportunity Management organization reads and customer service-account API security; deployment/patch-specific OAuth migration and partner integrations are separate checks. Dedicated accounts serve machine-to-machine applications and integrations. | CMiC service-account creation ↗Why Use an API Service Account?Checked 2026-10-16 |
| What rights or portability are documented for custom workflow artifacts? | -CMiC published Opportunity Management organization reads and customer service-account API security; deployment/patch-specific OAuth migration and partner integrations are separate checks. The reviewed CMiC route does not establish rights to custom logic. | CMiC Retrieve Organization reference ↗Reviewed route documentation; applicable scoring contract not establishedChecked 2026-10-16 |
| What usable data or native definitions can leave before cancellation? | Portable structured records on documented routes; whole-product completeness unverifiedCMiC published Opportunity Management organization reads and customer service-account API security; deployment/patch-specific OAuth migration and partner integrations are separate checks. Portable scoped organizations; whole-product files/history unverified. | CMiC Retrieve Organization reference ↗Overview / AttributesChecked 2026-10-16 |
SOURCES / SCOPE / HISTORY
Sources and open questions
This review is based on the documentation below. Live account behavior and customer-specific agreements haven’t been tested.
Still to confirm
- Plan/licensing and chosen-third-party eligibility
- Patch-specific OAuth production setup
- Numeric throughput and deletion/replay contract
- Current scoped write operation
- Full history/documents and native workflow portability
Documentation
Assessment checked 2026-10-16. Each answer retains its source and applicable route; the check date does not establish live account behavior.