import requests
import time
import random

def make_api_request_with_backoff(url, api_key, max_retries=5):
    headers = {"X-API-Key": api_key}
    
    for attempt in range(max_retries):
        response = requests.get(url, headers=headers)
        
        if response.status_code == 200:
            return response.json()
            
        if response.status_code == 429:
            if attempt == max_retries - 1:
                raise Exception("Rate limit exceeded after maximum retries")
                
            # Get retry time from headers or use exponential backoff
            retry_after = int(response.headers.get('X-RateLimit-Reset', 1))
            # Add jitter to prevent thundering herd
            sleep_time = retry_after + (random.random() * 0.5)
            print(f"Rate limited. Retrying after {sleep_time:.2f} seconds")
            time.sleep(sleep_time)
            continue
            
        # Handle other errors
        response.raise_for_status()
        
    raise Exception("Request failed after maximum retries")

## Compliance & Certifications

The TFE API is designed with security best practices that align with the following standards:

* **GDPR**: For handling personal data of EU residents
* **PSD2**: For payment services directives (where applicable)
* **ISO 27001**: Information security management principles
* **Financial Conduct Authority (FCA)**: Adherence to UK financial regulations

### Security Assessment

* Regular penetration testing by independent security firms
* Vulnerability scanning is performed weekly
* Security practices are continuously reviewed and updated
* Compliance with banking industry security standards

## Incident Response

### Security Incident Process

In the event of a security incident:

1. We will identify and contain the incident
2. We will notify affected clients within 24 hours
3. We will investigate the root cause
4. We will remediate vulnerabilities
5. We will provide post-incident reports to affected clients

### Reporting Security Issues

If you discover a security vulnerability, please report it to [security@tfe.ai](mailto:security@tfe.ai).

## Audit & Monitoring

### Request Auditing

All API requests are logged with the following information:

* Timestamp
* Client ID
* IP address
* Requested endpoint
* Response status code
* Request ID (returned in the `X-Request-ID` header)
* Request duration

These logs are used for:

* Security monitoring
* Compliance auditing
* Performance analysis
* Troubleshooting
* Threat detection

### Access Control Audit

All authentication events are logged:

* Successful and failed authentication attempts
* API key usage
* Token generation and usage
* Access to sensitive endpoints
* Administrative actions

### Monitoring System

Our monitoring system provides:

* Real-time alerting for suspicious activities
* Detection of unusual request patterns
* Continuous monitoring of security controls
* Automated response to potential threats
* Anomaly detection using machine learning

## Error Codes & Responses

The API uses standard HTTP status codes and a consistent error response format:

### HTTP Status Codes

* `200 OK`: Request successful
* `400 Bad Request`: Invalid request parameters
* `401 Unauthorized`: Authentication failed
* `403 Forbidden`: Insufficient permissions
* `404 Not Found`: Resource not found
* `429 Too Many Requests`: Rate limit exceeded
* `500 Internal Server Error`: Server-side error

### Error Response Format

```json
{
  "timestamp": "2023-07-01T14:30:00Z",
  "error": "Error type",
  "detail": "Human-readable error message"
}