Design

I think these are two 'issues' that you should open. 

1. What information can the Universal API access from an entity? What kinds of state information and relational information? What mechanism will be put into place to limit that scope?

2. Create a message header system that is include in all API Requests (much like email headers) that includes all the public information and authentication / identification information needed to `do business` with the Universal API.