6.1 Generating and Using API Tokens

You can generate an API token for an application and use the token in the required REST API request. You can generate multiple tokens for one application. You can generate tokens for all the resources for which you can check out credentials from the user console.

To generate an API token, perform the following:

  1. From Home > My Access, select the appropriate resource for which you need to generate a token.

    For example, if you want to generate a token for Shared Keys, select the resource Predefined Tags > Shared Keys.

  2. Click API Token > Generate Token.

  3. Specify the following details:

    Token Expiry: Duration for which the token is valid.

    Select Set Expiry if you want the token to be disabled after a specific duration and select the appropriate expiry date and time. These tokens expire after the configured duration. If you want to use the token after expiry, you can edit the token and modify the expiry duration.

    Select Never if you do not want the token to expire.

    Token Name: Name to identify the token.

    Access From: Represents the host from which the token can be authenticated.

    Select Any Host to allow token access from any host.

    Specify the Host IP / Host Name to allow the token access only from those hosts. To specify multiple hosts, use comma as a separator.

    Notes: Any additional information about this token.

  4. Click Generate Token.

    The generated token is added to the API Tokens list.

  5. Click to copy the appropriate token and use it as required. For more information about how to use tokens, see Using API Tokens.

6.1.1 Using API Tokens

After generating the tokens, copy the token and add it to the appropriate REST API request as needed to authenticate the request.

Usage Scenario:

For example, if you have a script that performs some operation on the database, the script must be authenticated for valid authorization. To enable the script for authentication, perform the following:

  1. Generate the token for the specific database from the user console.

  2. Copy and paste the generated token to the credential check-in and checkout REST API requests as described in the following sample:

    Sample REST API for Credential Check Out Using Tokens

    • Request: 

      curl --insecure -X POST -H "Authorization:Token token=<API_Token>" -H "Cache-Control: no-cache" -H "Content-Type:application/json" -d '{
        "Request": {
                    "type": "PasswordCheckout",
                      "runHost": "<Specify the target resource for which you want the credentials.>",
                    "reason": "<Reason for credential checkout.>",
                     "duration" : "<Specify the credential expiry duration in minutes. >",
                    "emailid": "<Specify your email address to get notifications. >"
                    }
    }'"https://<PAM_SERVER>/rest/cmdctrl/Request"

    • Response: 

      {
    "CheckOut": {
        "Request": {
            "id": "<Request Id>"
        },
        "account": "<username>",
        "passwd": "<password>"
    },
    "message": "OK",
    "status": 200,
    "vrm": "3.5.0"
}

    Sample REST API for Credential Check In Using Tokens

    • Request: 

      curl --insecure -X PUT -H "Authorization:Token token=<API_Token>" -H "Cache-Control: no-cache" -H "Content-Type:application/json" -d '{
        "Request": {
                     "type": "PasswordCheckin",
                     "runHost": "<Specify the target resource whose credentials must be checked in.>"
                   }
    }'"https://<PAM_SERVER>/rest/cmdctrl/Request/<Request Id>"

    • Response: 

      {
    "message": "OK",
    "status": 200,
    "vrm": "3.5.0"
}

  3. Include the credential check out and the check in REST API requests with the token in the script.

    The database authentication credentials are received as a response of the REST API request, which must be used by the script for logging in to the target application.

    Ensure that you call the REST API for credential check out and check in at the beginning and end of the script respectively.