| Plugin | A registered third-party integration listing in the Dentolize registry — a Plugin row. Not code running inside Dentolize; a description of an external service and what it's allowed to access. |
| Listing | Same thing as a plugin, emphasizing the marketplace-entry sense — what's shown in the Plugin Hub before install. |
| Installation | The record of one plugin connected to one specific clinic (company) — a PluginInstallation row. Holds the consent snapshot (granted scopes/events, DPA acceptance) independent of the plugin's current listing state. |
| Scope | A single, named permission a plugin can request, e.g. patients:read or appointments:write. Always belongs to exactly one sensitivity tier. |
| Tier | The sensitivity grouping of a scope: basic < operational < financial < patient_pii, in increasing sensitivity. Drives both consent-screen presentation and response field filtering. |
| PII | Personally identifiable information — in this platform specifically, direct patient identifiers (name, phone, national ID, etc.), gated behind the patient_pii tier and, for patient records specifically, the .pii suffix scopes. |
| DPA | Data Processing Agreement — the platform-owned legal terms a clinic accepts once per plugin install, making the plugin developer a data processor for that clinic's data. |
| Token | An API credential (dtz_live_… / dtz_test_…) a plugin uses to authenticate REST calls — a PluginToken row, stored only as a hash. |
| Webhook endpoint | A URL a clinic (or the plugin, via its own install instructions) registers to receive event notifications — a WebhookEndpoint row, with its own independent signing secret. |
| Signing secret | whsec_… — an HMAC key used to prove a webhook payload genuinely came from Dentolize, encrypted at rest, shown to the clinic exactly once. |
| Event | A single fired occurrence of something happening (e.g. one specific appointment being cancelled) — a WebhookEvent row, thin payload only. |
| Delivery | One attempt to deliver one event to one endpoint — a WebhookDelivery row, with its own retry/status lifecycle independent of the underlying event. |
| Live vs. test mode | LIVE tokens work only in production; TEST tokens (dtz_test_…) work only in the sandbox — the two environments never share data, and one mode's tokens are always rejected in the other. |
| Consent snapshot | The grantedScopes/grantedEvents/pluginVersionAtConsent fields on PluginInstallation — a frozen copy of what was agreed to at install time, not a live pointer to the plugin's current requested scopes. |
| Idempotency key | A client-supplied header (Idempotency-Key) required on every POST, letting a retried request return the original result instead of repeating a side effect (critical for payments). |