Managing Access Tokens
If the Is CentraSite based API Management Profile active? is set to false, API-Portal, by default, displays the Get Access Tokens link in the API details page. The values entered in the Get Access Token dialog box will be sent in an email to the users in the API Consumption Approvers group.
The Get Access Token dialog box is fully customizable so that all the required information can be obtained from the users requesting the keys. For more details, see API-Portal Customization guide.
Once the key is approved and processed, the third party key management system should use the REST Service with endpoint /abs/apirepository/accesstokens/external with the values UserId, Properties (Key Value) to populate the access token details in API-Portal.
EndPoint: http://<host>:<port>/abs/apirepository/accesstokens/external
Method: POST
Content Type: application/json
Authorization: Basic Auth (Username/password of users in API Consumption Approvers group)
Input Schema (Payload)
{
"user":" Id of the user who requested the token. Can be obtained from the
email sent from API-Portal",
"propertyList": [
{
"key": "applicationName", //Mandatory Input
"value": "App name"
},
{
"key": "Access Token Type", //Mandatory Input
"value": "Value 1"
},
{
"key": "Key 2",
"value": "Value 2"
}
…
]
}
Sample Payload
{
"user":"4ee9c60c-c32e-3615-83c4-5dc6822c45de",
"propertyList": [
{
"key": "applicationName",
"value": "Weather App"
},
{
"key": "Access Token Type",
"value": "API Key"
},
{
"key": "x-Api-Key",
"value": "F46805559A46CBB236B34EAB761A8163 "
},
{
"key": "How To Use",
"value": "use this key in query parameter"
},
{
"key": "Expiration Date",
"value": "22-10-2016"
}
]
}
Sample Response Payload
672a9c60c-c3se-3115-13c4-5dc6822c45fd (tokenId - to be stored by third-party system for future reference)
The Access Tokens page now displays the list of access tokens and each of these tokens will have an option to Revoke and Renew.
Revoking a token sends an email request with token id and user details to the configured provider. Upon successful deletion of the token, the provider must invoke "/abs/apirepository/accesstokens/external/tokenId". This deletes the token from API-Portal.
EndPoint: http://<host>:<port>/abs/apirepository/accesstokens/external/tokenId
Method: DELETE
Authorization: Basic Auth (Username/password of users in API Consumption Approvers group)
Renewing a token sends an email request with token id and user details to the configured provider. Upon successful renewal of the token, the provider must invoke PUT on "/abs/apirepository/accesstokens/external/tokenId". This renews the token in API-Portal.
EndPoint: http://<host>:<port>/abs/apirepository/accesstokens/external/tokenId
Method: PUT
Authorization: Basic Auth (Username/password of users in API Consumption Approvers group)
Input Schema (Payload)
{
"user":" Id of the user who requested the token. Can be obtained from the
email sent from API-Portal",
"propertyList": [
{
"key": "applicationName", //Mandatory Input
"value": "App name"
},
{
"key": "Access Token Type", //Mandatory Input
"value": "Value 1"
},
{
"key": "Key 2",
"value": "Value 2"
}
…
]
}
Sample Payload
{
"user":"4ee9c60c-c32e-3615-83c4-5dc6822c45de",
"propertyList": [
{
"key": "applicationName",
"value": "Weather App"
},
{
"key": "Access Token Type",
"value": "API Key"
},
{
"key": "x-Api-Key",
"value": "F46805559A46CBB236B34EAB761A8163 "
},
{
"key": "How To Use",
"value": ""use this key in query parameter"
}
{
"key": "Expiration Date",
"value": "22-10-2017"
}
]
}
Note: | In case of third party key management, the API Tryout will not enforce any access token restrictions except for BASIC Auth. |
Note: | For information on using the Get Access Token dialog and Access Tokens page details, see webMethods API-Portal Online Help. |
Contact Support
|
Community
|
Feedback