| Table of Contents | ||||
|---|---|---|---|---|
|
More information on the API can be found on the API page.
API
...
Keys Grid
'API PermissionsKeys' are a list of available permissions that will allow access to the data within the PCR-360 database via the API. Users can access and view the various API permissions that are being used within an organization from the Admin > API > API PermissionsKeys navigation option.
Whenever adding or editing an API permission, the API key will be randomly generated and disabled from User modifications. Users can select the Read and Write access in various sections like 'Services', 'Equipment', 'Service Desk', and 'SNMP'. This Grid allows the User to 'Add' 
, ' Edit' 
, or 'Delete' 
API Key Permissions.
Permissions Tab
A User input description is recommended whenever adding a new API Permission. This will create clarity when examining multiple API Permissions sets.
Add
Select the desired 'API Permission' and set any desired Expiration Date. Depending on API Endpoint, you will see fields for granting Read and Write permissions.
Edit
Users can 'Edit' can an existing API Permission if there are problems with the initial configuration.
Delete
Users can 'Delete' an existing API Permission. Care should be exercised in this action to make sure that the Permission is not being used elsewhere by PCR-360.
Users Tab
From 'API Users' Grid the User is able to 'Add' to , 'Edit'
, or 'Delete'
API Keys associated to a User's Session.
Add
From the 'Add New API Users' Form, the User is prompted to Select a 'User', and Set an 'Expiration Date' for their Session.
Edit
From the 'Manage API Users' Form, only the 'Expiration Date' for the selected User's Session can be updated.
Delete
When an API User is removed from the system, all other associated API Sessions will be deleted as part of the action.
Tokens Tab
From 'API Tokens' Grid the User is able to API Keys Tokens associated to a User's Session. This is very useful if somehow an API Token becomes compromised and another User begins using the Token as well; an Admin User can immediately remove the Token and force all Users of that API Key to re-authenticate, rather than having to wait for the Token to expire.
User Access Validation for the API
Anonymous Mode
This mode of accessing the API has been depreciatedHTTP POST is required for the login endpoint.
A basic request looks like this:
...
By sending the API_KEY in the Request, the API is able to validate if the user is able to perform the intended operation using the API.
Token Authentication
...
The Authentication Token is a JSON Web Token.
API Authentication Headers
...
The system configuration AUTH_SESSION_LIFETIME_SECONDS defines the length of time a Session is valid. If this parameter is set to "0", then the Session is set to not expire as long as the User. Any other value to cause the User to need to get a new Token after the defined interval, regardless of User Activity.
The system configuration AUTH_SESSION_ACTIVITY_SECONDS defined the length of time a User's Session is valid, before it times out do to Inactivity.
For more detail on these configuration values, please see the Authentication Configuration Wiki Page.
All expired tokens for the user and API key will be deleted.
API Logout
To end your Session with the API, call the Logout Endpoint. This will end your current Session, and require you to authenticate again before you make another call using the API.
...