API Keys

In addition to the standard user login, you can also use an API key to access the BPC API. This allows for direct authentication when calling the API. Without an API key, a separate authentication call must be made before accessing an API function.

An API key corresponds to a static session in BPC. Like a user session, it contains attributes such as assigned organizations, roles, and permissions. Each API key has a defined validity period. Additionally, it is possible to specify by whom and for whom this API key was issued.

Using the API Key

For BPC to accept the API key for authentication, it must be included in the HTTP header X-APIKey.

Example

curl --header "X-APIKey: BPC-API-1567679439690" 'http://localhost:8181/cxf/bpc-core/status'

Managing API Keys

Setting

API keys can be configured directly via the core settings API_Keys. Using the dedicated editor (see below) is preferred.

Example API_Keys configuration

{
  "BPC-API-1567758383120": {
    "issuedFor": "Thomas",
    "issuedBy": "bpcadmin",
    "issuedOn": "2019-09-05 12:30:39",
    "expiresIn": "30 days",
    "assignedRoles": [
      "bpcadmin"
    ],
    "assignedRights": [],
    "assignedOrganisations": []
  }
}

Editor / Interface

Alternatively, configuration via the BPC interface is possible:

api keys editor

Keywords: