Skip to main content
Version: 3.25

Default Request Usage

Every request into WebService A2A must target requests to the base URI. So, lets understand the URI structure.

https://senhasegura/iso/*MODULE*/*FUNCTION*

  • MODULE: senhasegura WebService A2A function module

  • FUNCTION: Module function

From this point ahead, you must understand which authentication method you will use.

Without OAuth Authentication​

caution

This method is not recommend by senhasegura . Avoid it if OAuth v2.0 can be used.

Every request into WebService A2A should have the client OAuth Consumer Key and the client OAuth Token. By this way, every request URI looks like the following example.

https://senhasegura/iso/*MODULE*/*FUNCTION*?oauth_consumer_key=*KEY*& 
oauth_token=*TOKEN*

  • MODULE: senhasegura WebService A2A function module

  • FUNCTION: Module function

  • KEY: Client OAuth key

  • TOKEN: Client OAuth token

caution

When using a GET method, do not forget to append oauth_consumer_key and oauth_token before the function extra arguments.

When using POST methods, both parameters must be filled at the URL as a GET method.

Using OAuth v1.0 Authentication​

caution

This method is not recommend by senhasegura . Avoid it if OAuth v2.0 can be used.

Using OAuth v1.0, ensure that oauth_signature_method used is HMAC-SHA1 and oauth_version is setted to 1.0.

oauth_timestamp, oauth_nonce and oauth_signature are mandatory.

You can find the full spec about OAuth v1.0 at RFC 58492.

Using OAuth v2.0 Authentication​

Using OAuth v2.0, your application must renew the authorization token when its expire. By default, senhasegura will create this token valid for a day.

Using the registered and approved Client Key and Client Secret, request a new token to WebService A2A using the following URI:

POST https://senhasegura/iso/oauth2/token

This request must have the Basic Authorization header. See the section "2.3 Client Authentication" into RFC 67493 for better understand.

Your application will receive a JSON dictionary similar as the following example:

{
    "token_type": "Bearer",
    "expires_in": 3600,
    "access_token": "
        eyJ0eXAiOiJKV1QiL0IjoxNTgwNDM2NTk4LCJuYmYiOjE1ODA0MzY1OTgsImV4cCI
        6MTU4MDQ0MDE5OCwic3ViIjoiTVRNeE1qQWtTRGRPUVRWV1ozcEVSI6Ijg0OWYw
        ZmVhNDI0ZDc5NWUwYTg2MjVlMTdiZWE2YTAyNTQyMzAxNjQzYmRmYTc5ZjYzZDN
        hM2U3ZmI5ZjQzbGCJhjg0OWYwZmVhNDI0ZDc5NWUwYTg2MjVlMTdiZWE2YTAyNT
        QyMzAxNjQzYmRmYTc5ZjYzZDNhM2U3ZmI5ZjQzYmM2MjRhYzg5YmVhMzFhOGQwI
        iwiaWFciOiJSUzI1NiIsImp0ahYzg5YmVhMzFhOGQwIn0.eyJhdWQiOiIzY2E4Y
        Tk4ZDkwNzU0MzgxMjMzNGY3ZjVkYmFmY2E2NTA1ZTMzMTlmYiIsImp0aSI6IYmM
        2MjRTRzB6ZFZONlZXVXhhVWN2Y1RKdFRXNTVhM05sZGtOd1JHeHllbXR5VEV3eE
        5EMD0iLCJzY29wZXMiOltdfQ.efqHZdlij6sQcj_l9RbNNKxDbf81CbIoTFwdIk
        ooT5bK14N5iUazrT8jpB_JsgQdQ8RyD5xF_ReKSj4Al7hp1uRXIiuErlKv1FpxY
        9oNC44kldlumjyevu87GJ0qzem0RYNc3930UbT-XEYqnQijg0se8_GdzdLkxyMn
        0kxApkAkv-to9EUdbbrvvno_pmqiZGyamw6J2BL1aCqwne3S8CCG34TXRyJyqkG
        rPrDO-NPi2fj25PRbX8Ci1iIqXdYvEkefg-g-i0A_Hp9E3s585c5wqxreSBAIwi
        aGtnTkxw0D14JPzqWf48hbvVRPGMj_-KXJTnu-zXkkEPNYs8oWpA"
}

Cache the access_token. It should be used into every next method call. Fill the request header Authorization with the token_type and access_token values. You can check the RFC 6749 section "7.1. Access Token Types" for more details.

info

It is possible to link an SSL certificate fingerprint to a customer's authorization WebService A2A .

If linked, the senhasegura will validate the CA of the client's SSL certificate with each request, as an additional authentication step.

The use of the certificate does not invalidate or replace validation using OAuth methods.