Two planes, one clear boundary

Inbound

Your integration calls the PartnAir API with a scoped PartnAir key.

Outbound

PartnAir calls the ERP with an encrypted credential managed only in the private admin.