API Guide

Authentication
Several common schemes are available for enabling authentication of REST requests. Basic Authentication and X-Auth-Token
Authentication are some of the common schemes.
Basic authentication
The authorization header in the request has the base-64 encoding of the credentials—username and password. If you do not
provide the credentials, a 401—Authorization Failure error is returned. Basic Authentication is supported only when SSL/TLS is
used for the transport.
X-Auth-Token authentication
X-Auth-Token Authentication provides a more secure implementation. To establish a session, perform a POST operation on the
SessionService REST API.
POST https://10.35.0.133/api/SessionService/Sessions
Input
{
"UserName":"root",
"Password":"linux",
"SessionType":"API"
}
The X-Auth-Token is available in the header that is returned.
connection →Keep-Alive
content-length →268
content-type →application/json; odata.metadata=minimal
date →Tue, 05 Sep 2017 11:55:29 GMT
keep-alive →timeout=5, max=150
location →/api/SessionService/Sessions('e1817fe6-97e5-4ea0-88a9-d865c7302152')
odata-version →4.0
server →Apache
x-auth-token →13bc3f63-9376-44dc-a09f-3a94591a7c5d
x-frame-options →DENY
This X-Auth-Token is used in the header for subsequent REST operations and to authenticate the user.
Authorization
Table 2. Authentication and authorization requirements
Actions Authentication required Authorization required
Read operation on any instrumentation
data
Y Y
Modify instrumentation data Y Y
Invoke actions Y Y
View service root N N
View metadata document N N
View OData service document N N
View message registry Y N
View Redfish version URI N N
View JSONSchemaFile resource URI N/A N/A
Key integration concepts 19