Concepts and architecture

Riversoft® STCP DirectLink is Riversoft’s managed file transfer (MFT) product for people, systems and partners:

• People: web portal, in the browser.
• Systems: REST API.
• Partners: SFTP, AS2 and Webhook.
• Other destinations: WhatsApp and cloud storage (Amazon S3, Azure Blob Storage, Google Cloud Storage and Oracle Cloud Object Storage).

For exchanges over the OFTP protocol, use Riversoft STCP Gemini. Both products can be used together or separately and share management through the Riversoft Console Portal and the mailboxes.

Architecture

Riversoft STCP Gemini and Riversoft STCP DirectLink are independent products that can be used together or separately. Both are configured and monitored through the Riversoft Console Portal and the Riversoft STCP Gemini API, and the configuration, records and transfer history are kept in your company’s database.

    flowchart LR
    ADM[Administrator] -->|HTTPS| PORTAL[Riversoft Console Portal]
    SIS[External systems] -->|HTTPS / REST| API[Riversoft STCP Gemini API]
    PORTAL --> API
    API --> DB[(Configuration database<br/>and log database)]
    SRV[Riversoft STCP Gemini Server] --> DB
    DL[Riversoft STCP DirectLink] --> DB
    REN[Riversoft STCP Gemini Rename] --> DB
    SRV <-->|OFTP| PARC[Partners]
    DL <-->|SFTP, AS2, HTTPS, Webhook,<br/>S3, Azure Blob, GCS, OCI| PARC
    SRV -->|events| REN
  

Components

Protocols and connectors

Riversoft STCP DirectLink serves people, systems and partners, each through the most suitable channel:

    flowchart LR
    U[User in the browser] -->|HTTPS| P[Riversoft STCP DirectLink Portal]
    S[Integrated system] -->|HTTPS / REST API| A[Riversoft STCP DirectLink]
    PS[Service portal] -->|JWT token exchange| A
    IdP[Identity provider] -.->|SSO OAuth 2.0 / SAML 2.0| A
    P --> A
    PARC[Partners] <-->|SFTP, AS2, Webhook| A
    A <-->|S3, Azure, GCS, OCI| N[Cloud storage]
    A -.->|email, SMS, WhatsApp| D[External recipient]
    G[Riversoft Console Portal and<br/>Riversoft STCP Gemini API] -->|configure and monitor| A
  

The table below shows which product handles each protocol or connector. Details are in Protocols and connectors.

How a transfer works

Sending and receiving through the API

Protected routes require a Bearer token. The password is presented only once, when obtaining the token.

    sequenceDiagram
    autonumber
    participant App as Client application
    participant DL as Riversoft STCP DirectLink API
    App->>DL: POST /oauth2/token (password grant or token exchange)
    DL-->>App: access_token (Bearer)
    App->>DL: POST /upload (Authorization: Bearer)
    DL-->>App: Upload confirmed
    App->>DL: GET /download/list (Authorization: Bearer)
    DL-->>App: File list with linkURL (secure link)
    App->>DL: GET linkURL (/download/file?...) with Bearer token
    DL-->>App: File content and X-STCPDIRECTLINK-HASH header
    Note over DL: The file moves to the backup area
  

Where an uploaded file goes depends on what is provided in the upload:

The download list shows the files in the saida directory. After the download, the file is moved to the backup area (saida/backup).

Secure link for external recipients

When sending a file, you can provide a recipient’s email address or mobile number. The recipient receives a secure link for download, which identifies the email address or mobile number linked to the file and only releases the download with a security code (PIN).

    sequenceDiagram
    autonumber
    participant R as Sender
    participant DL as Riversoft STCP DirectLink
    participant D as Recipient
    R->>DL: Upload with the recipient's email or mobile number
    DL->>D: Secure link (email, SMS or WhatsApp)
    D->>DL: Opens the link
    DL->>D: Security code (only to the linked email or mobile number)
    D->>DL: Enters the code within the validity period
    DL-->>D: File download
  

Trusted JWT authentication

Service portals can authenticate their users in Riversoft STCP DirectLink by exchanging a JWT, signed with the portal’s private key, for a Riversoft STCP DirectLink Bearer token (token exchange). Riversoft STCP DirectLink validates the JWT with the JWT provider configuration registered by the administrator. The full flow is in Security.

Inbound and outbound connections

Mailbox and directories

Each user has a mailbox in the data directory (DataDirectory, by default /usr/local/stcp/data), at the path <DataDirectory>/<instance>/<user>/. Riversoft STCP Gemini and Riversoft STCP DirectLink use exactly the same mailbox structure:

<DataDirectory>/<instance>/<user>/
├── entrada/
│   └── restart/
├── saida/
│   ├── backup/
│   ├── pendente/
│   └── link/
├── controle/
├── formato/
└── temp/

    flowchart LR
    SIS[Company system] -->|writes| SAI[saida]
    SAI -->|sent or downloaded| BKP[saida/backup]
    BKP -.->|resend| SAI
    PARC[Partner or user] -->|sends| ENT[entrada]
    ENT -->|read by| SIS
  

Directory names are configurable in the instance. See Data directories.

File areas

In the Riversoft STCP DirectLink interface, each user sees three areas of their mailbox:

Rules applied to each transfer

Before accepting an upload or releasing a download, Riversoft STCP DirectLink checks the operation against the user’s rules:

Every operation, accepted or rejected, is recorded. See Security.

Routing and automation

With routing enabled, Riversoft STCP DirectLink periodically scans the configured directories and forwards each file it finds according to a distribution table (CSV), which maps the file’s origin to the destinations and recipients.

    flowchart LR
    ARQ[File found<br/>in the directory] --> TAB{Distribution<br/>table}
    TAB -->|copy| DEST[Destination directory]
    TAB -->|link| LINK[Secure link for<br/>the recipients]
    TAB -->|external command| CMD[Company program]
    TAB --> BKP[Backup of the original]
  

For more elaborate rename, copy, move and distribution rules, use Riversoft STCP Gemini Rename. The parameters are in Configuration › Routing and distribution.

Logging and monitoring

See Monitoring and auditing.

Key concepts

Other terms are in the Glossary.