Authentication

In April 2020, to improve data security, the ACTIVENet System APIs have enhanced authentication that requires an additional dynamic digital signature in every API request.

Impact on existing and new API users

To enable the enhanced-security ACTIVENet System APIs, please follow this procedure:

Enabling the Public APIs license

To access the ACTIVE Net System API, you must have a valid Public APIs license. When your license expires, your access to the API will cease, even if you possess the API key.

Note that Calling a POST or PUT API require a write-access API key. To apply for a write-access API key, please contact the ACTIVENet support team.

Requesting an API key and a sharedSecret key

An API key is an alphanumeric Universal Unique Identifier (UUID) string generated by ACTIVE Net, for example: 1234567890xn3xnteudxsavw. The API Key authenticates your organization's access to the API.

A sharedSerect key is a string used along with the API key to generate a digital signature.

The digital signature is a dynamic, 64-digit string encrypted using the API key, the sharedSecret key and a timestamp. The digital signature allows the API server to verify that an API request using your API key is authorized to access ACTIVENet data.

Generating a dynamic digital signature

Refer to the following Java code example on generating a dynamic digital signature. The token string is the dynamic digital signature to be used in an API request.

package com.activenet.web;

import java.io.BufferedReader;

import java.io.IOException;

import java.io.InputStream;

import java.io.InputStreamReader;

import java.net.HttpURLConnection;

import java.net.MalformedURLException;

import java.net.URL;

import java.nio.charset.StandardCharsets;

import java.security.MessageDigest;

import java.security.NoSuchAlgorithmException;

import java.time.Instant;

public class MasheryAuthenticationTest {

/**

* Create token with SHA-256

* @param message

* @return

private static String sha256Hash(String message) {

MessageDigest md = null;

try {

md = MessageDigest.getInstance("SHA-256");

} catch (NoSuchAlgorithmException e) {

e.printStackTrace();

}

md.update(message.getBytes(StandardCharsets.UTF_8));

byte[] hash = md.digest();

StringBuffer hexString = new StringBuffer();

for (int i = 0; i < hash.length; i++) {

String hex = Integer.toHexString(0xff & hash[i]);

if(hex.length() == 1) hexString.append('0');

hexString.append(hex);

}

return hexString.toString();

}

/**

* Get current timestamp

* @return

private static String getTimestamp() {

Instant instant = Instant.now();

long timeStampEpochSeconds = instant.getEpochSecond();

return String.valueOf(timeStampEpochSeconds);

}

/**Test request a API with token

* @param args

* @throws MalformedURLException

* @throws IOException

public static void main(String[] args) throws MalformedURLException, IOException {

String apiKey = "12345678902jvnsj9sjtaeg2";

String sharedSecret = "12345KQ6nU";

String url = "https://api.amp.active.com/anet-systemapi-stg-sec/orgtest/api/v1/activities?activity_status_id=1&site_ids=101,102&api_key=12345678902jvnsj9sjtaeg2&sig=";

String timestamp = getTimestamp();

System.out.println("Timestamp: " + timestamp);

// Generate token from api key, shared key and timestamp.

String token = sha256Hash(apiKey + sharedSecret + timestamp);

System.out.println(token);

url = url + token;

System.out.println("URL is " + url);

// Send HTTP request based on URL.

HttpURLConnection con = (HttpURLConnection) new URL(url).openConnection();

con.setRequestMethod("GET");

int status = con.getResponseCode();

System.out.println("Response code: " + status);

InputStream input = null;

if (status < 400) {

input = con.getInputStream();

} else {

input = con.getErrorStream();

}

BufferedReader in = new BufferedReader(

new InputStreamReader(input));

String inputLine;

// Handle API response.

StringBuffer content = new StringBuffer();

while ((inputLine = in.readLine()) != null) {

content.append(inputLine);

}

in.close();

System.out.println(content.toString());

con.disconnect();

}

Making an API request with an API key and a digital signature

If you have enabled the enhanced-security APIs, then the API request URL requires the following changes: