View source for Updox HMAC Authentication

== Description ==
For enhanced security, Updox provides an additional layer of authentication using a keyed-hash message authentication code (HMAC) with SHA1 as the cryptographic hash function. This document outlines how to use the Updox HMAC-SHA1 authentication.

Note: Updox HMAC-SHA1 enhances the Individual and Application Authorization schemes, it does not replace it. The auth header in the body of the post is still required for authorizing as a vendor, account, and user.

  
  
  
  
== Outline ==
The Updox HMAC-SHA1 authentication layer requires two http header fields for every request:

1. updox-timestamp - the current time in the format "yyyy-MM-dd HH:mm:ss (z)".

2. Authorization - "HMAC:" + the Base64 encoded HMAC SHA1 hash of the message with the secret key.

The message is defined as: [vendorId]:[vendorPassword]:[updox-timestamp]

== Verification ==
Updox will verify two things:

1. The timestamp header (updox-timestamp) is within the minutes defined for the vendor (e.g. 10 minutes).

2. The hash passed in matches the hash we compute (therefore, the message was signed with the secret key).

== Code Samples ==
{| class="wikitable" style="width:900px; vertical-align:top; align:left"
! Language || Source Code Examples
|-
| width="50px"| C# || <div class="mw-collapsible mw-collapsed" style="width:65px">
<div class="mw-collapsible-content" style="width:810px">
</div>
|-
| align="top" | Java || <div class="mw-collapsible mw-collapsed" style="width:65px">
<div class="mw-collapsible-content" style="width:810px">
{{Json API HMAC Block- Java}}
|}

  
  
  
== Messages ==
=== Destination Address ===
<div style="width:500px;">
  {{Base url api|pingWithAuth|pingWithAuth}}
</div>




== Sample Request and Response ==

==== Headers ====
updox-timestamp: 2013-11-20 17:36:00 (EST)

Authorization: fH2JyYwiERQbwXL4XF6ZvtLjRvQ=

==== Request ====
 {
     "auth": {
         "applicationId": "updox",
         "applicationPassword": "password",
         "accountId": "100",
         "userId": "100"
     }
 }

==== Response ====

 {
     "successful": true,
     "responseMessage": "OK",
     "responseCode": 2000
 }

== Relevant Response Codes == 
{{Relevant Response Codes Table Header}}
{{Response Code Table Row|4010}}