AuCore by Authasas

Welcome! Let’s begin.

General rule

Almost all methods requires login_session_id or endpoint_session_id. Examples below don’t show them for short. Service description says what session the service requires.

POST, PUT, PATCH methods accept json bodies. Add xxx_session_id to the body:

POST /api/v1/enroll
{
    'login_session_id': '789'
    'method_id': 'HOTP:1'
}

GET, DELETE methods accept no body. Add xxx_session_id to query string:

GET /api/v1/logon/chains?endpoint_session_id=123&event=WindowsLogon

DELETE /api/v1/users/456/data/OSLogon/Password?login_session_id=789

Secrets

  1. login_session_id
  2. endpoint_session_id
  3. endpoint secret stored on endpoint device, passed as endpoint_secret_hash

If you know xxx_session_id you can remove session (logout user) or read /data - acts on behalf of user/endpoint.

Error reporting

Normally server respond with HTTP status 200 and JSON body (as described in corresponding service). In case of error, HTTP status may be 40x, 50x. Response body will be JSON structured as follows:

{
    "status": "error",
    "errors":
     [
        {"location":"client",
         "name":"Forbidden",
         "description":"Login session not found"}
     ]
}

All you need is ‘description’ of first error. Ignore other fields.

Special HTTP errors

HTTP 433 - endpoint session not found or expired.
It is possible to get this error in the middle of logon process. You may start new endpoint session, resend do_logon request and continue.

HTTP 434 - logon session not found or expired. Re-logon.

HTTP 400 - wrong data (missed fields etc.) or method protocol violation
e.g. voice method already did phone call and wait for PIN code, but you ask it to call user again. Fix your data and retry.
HTTP 500 - serious error, usually not possible to retry. Start your operation
from the beginning (open new logon process, etc.)

Read HTTP error description, it may help debug.