Initiate the authentication

The bearer token. The access token is returned in response of /oauth2/token endpoint. Mandatory if OAuth2 protocol is required to secure the API.

The date and time of the request. Mandatory if OAuth2 protocol is required to secure the API.

The digest of the request, corresponding to the SHA-256 hash of the payload, encoded in Base64, prefixed by "SHA-256=". Mandatory if OAuth2 protocol is required to secure the API.

The HTTP Signature of the request, including the 4 following parameters:

• keyId: The client ID of APM platform defined during the Oauth 2.0 project;
• algorithm: The algorithm used to sign the request, corresponding to the RSA-SHA256 algorithm;
• headers: The list of headers included in the signature, separated by a space, which is currently "(request-target) date digest";
• signature: The signature of the headers value, using the chosen algorithm (rsa-sha256).

Mandatory if OAuth2 protocol using HTTP signature is required to secure the API.

The JWS Signature of the request, composed of [protected_header].[payload].[signature], where:

• [protected_header] is a base64 encoded JSON composed of parameters:
  • b64: Parameter set to false;
  • x5t#S256: The digest (fingerprint) of the X.509 signing certificate using SHA 256, that shall be checked against the certificate used to validate the signature;
  • crit: Critical non-standard JWS header parameters (not defined in RFC 7515), set to ["sigT","sigD","b64"];
  • sigT: The date and time of the signature creation, to the second, indicated in UTC (ending with Z);
  • sigD: Parameter that shall contain:
    • mId: Parameter set to http://uri.etsi.org/19182/HttpHeaders;
    • pars: List including the following HTTP header field names: (request-target), content-type, digest;
  • alg: The algorithm used to sign the request, set to RS256;
• [payload] is empty;
• [signature] is the Base64 encoded signature of protected_header concatenated with HTTP header strings.

Example of protected_header before Base64 encoding:

{
  "b64": false,
  "x5t#S256": "dytPpSkJYzhTdPXSWP7jhXgG4kCOWIWGiesdzkvNLzY",
  "crit": [
    "sigT",
    "sigD",
    "b64"
  ],
  "sigT": "2023-11-26T11:26:57Z",
  "sigD": {
    "pars": [
      "(request-target)",
      "content-type",
      "digest"
    ],
    "mId": "http://uri.etsi.org/19182/HttpHeaders"
  },
  "alg": "RS256"
}

Example of resulting Base64 encoded protected_header (without line breaks or extra spaces):

eyJiNjQiOmZhbHNlLCJ4NXQjUzI1NiI6ImR5dFBwU2tKWXpoVGRQWFNXUDdqaFhnRzRrQ09XSVdHaWVzZHprdk5MelkiLCJjcml0IjpbInNpZ1QiLCJzaWdEIiwiYjY0Il0sInNpZ1QiOiIyMDIzLTExLTI2VDExOjI2OjU3WiIsInNpZ0QiOnsicGFycyI6WyIocmVxdWVzdC10YXJnZXQpIiwiY29udGVudC10eXBlIiwiZGlnZXN0Il0sIm1JZCI6Imh0dHA6Ly91cmkuZXRzaS5vcmcvMTkxODIvSHR0cEhlYWRlcnMifSwiYWxnIjoiUlMyNTYifQ

Example of HTTP headers:

(request-target): post /initiateAuthentication
content-type: application/json
digest: SHA-256=+xeh7JAayYPh8K13UnQCBBcniZzsyat+KDiuy8aZYdI=

Example of resulting input data for signature:

eyJiNjQiOmZhbHNlLCJ4NXQjUzI1NiI6ImR5dFBwU2tKWXpoVGRQWFNXUDdqaFhnRzRrQ09XSVdHaWVzZHprdk5MelkiLCJjcml0IjpbInNpZ1QiLCJzaWdEIiwiYjY0Il0sInNpZ1QiOiIyMDIzLTExLTI2VDExOjI2OjU3WiIsInNpZ0QiOnsicGFycyI6WyIocmVxdWVzdC10YXJnZXQpIiwiY29udGVudC10eXBlIiwiZGlnZXN0Il0sIm1JZCI6Imh0dHA6Ly91cmkuZXRzaS5vcmcvMTkxODIvSHR0cEhlYWRlcnMifSwiYWxnIjoiUlMyNTYifQ.(request-target): post /initiateAuthentication
content-type: application/json
digest: SHA-256=+xeh7JAayYPh8K13UnQCBBcniZzsyat+KDiuy8aZYdI=

Example of signed data:

Q9ZSYXJ0QWSoPBfBUR58Sqplw7BQcrcqVR6rvnqfBOvosbBLcsBjkjzi1kCF 2cJsHTJRtp6GcJmZplqRg-7_QBKQAgkUq0BGQpzZwhVYrvP0opdLEarVBrej YA05gt3qnleuS53DWmyZu9iNxhwJTYVPyXediwo3TIlSn-8XjSTZAVHa728E WK6XzRC9rEroXYPYd23iQLXetMygLaDhRT2lGhV5WvmO0wC0B6RbGiYl2zIv D0XliMP6MidX4SDY5zlzyWyFlHqX7eHpkH8xxqAsBdKb16y4IdOoRhil9yws vlzkG6-U9jmBU4y_m3mZArD22oRVXTywzFn9NUtY9w

Example of resulting JWS:

eyJiNjQiOmZhbHNlLCJ4NXQjUzI1NiI6ImR5dFBwU2tKWXpoVGRQWFNXUDdqaFhnRzRrQ09XSVdHaWVzZHprdk5MelkiLCJjcml0IjpbInNpZ1QiLCJzaWdEIiwiYjY0Il0sInNpZ1QiOiIyMDIzLTExLTI2VDExOjI2OjU3WiIsInNpZ0QiOnsicGFycyI6WyIocmVxdWVzdC10YXJnZXQpIiwiY29udGVudC10eXBlIiwiZGlnZXN0Il0sIm1JZCI6Imh0dHA6Ly91cmkuZXRzaS5vcmcvMTkxODIvSHR0cEhlYWRlcnMifSwiYWxnIjoiUlMyNTYifQ..Q9ZSYXJ0QWSoPBfBUR58Sqplw7BQcrcqVR6rvnqfBOvosbBLcsBjkjzi1kCF 2cJsHTJRtp6GcJmZplqRg-7_QBKQAgkUq0BGQpzZwhVYrvP0opdLEarVBrej YA05gt3qnleuS53DWmyZu9iNxhwJTYVPyXediwo3TIlSn-8XjSTZAVHa728E WK6XzRC9rEroXYPYd23iQLXetMygLaDhRT2lGhV5WvmO0wC0B6RbGiYl2zIv D0XliMP6MidX4SDY5zlzyWyFlHqX7eHpkH8xxqAsBdKb16y4IdOoRhil9yws vlzkG6-U9jmBU4y_m3mZArD22oRVXTywzFn9NUtY9w

Mandatory if OAuth2 protocol using JWS signature is required to secure the API."