API Guide

Security
The authentication and authorization flows are prerequisites to any API invocation. The request is forwarded to the CXF server
defined for the REST API after the invocation.
If there is authorization and authentication failure, an appropriate error code with message is sent to the API client.
On success, the request is forwarded to the appropriate REST service endpoint (API) defined on the CXF servlet.
Topics:
• OMIVV authentication
• vCenter authorization
OMIVV authentication
OMIVV web server handles incoming web requests and routes them to the REST endpoints.
● Authentication server performs the following:
○ Accepts login requests and provide the bearer token. This token is generated using the JWT scheme that includes a
header, body, and footer.
○ Accepts log out requests which closes the session
● API server: Service all defined REST endpoints except endpoints that are related to authentication.
API clients establish a session with the API server using the endpoint: /Services/AuthenticationService/login.
OMIVV user credentials are required to authenticate a client of the RESTful API. Only user profile with admin privilege is allowed
to log in as an API user. Other user profiles with privileges like Read only cannot access the API.
Sample code to create an OMIVV session:
```json
def login_with_OMIVV (omivvIP,username,domain, password):
baseurl ="https://" + omivvIP + "/Spectre/api/rest/v1/Services/AuthenticationService/
login"
postBodyData={"apiUserCredential" : {"username":username,"domain" :
domain,"password" : password}}
jsonReponse = requests.post(baseurl, json=postBodyData, verify=False)
if(jsonReponse.status_code == 200):
bearerToken = jsonReponse['accessToken']
return bearerToken
else:
print("Login failed")
```
omivvIP can be a valid OMIVV IP or FQDN.
Bearer Token
Each session that is created using an authentication service contains a bearer token that is generated using the JWT scheme.
Expiration period for bearer token is 60 minutes. If you are using the token after 60 minutes, Token is already expired
message is sent to the API client.
The account lockout duration is one minute. If an account lockout happens after creating the Bearer token, bearer token cannot
be used during lockout duration (one minute). After an account lockout duration, same Bearer token can be used until it expires.
3
Security 11