API Lab · class day 49
Authorization and chaining
Basic, bearer token, API key and OAuth 2 (client credentials), and users and orders to chain together.
Send X-Sandbox: your-name with every request to get your own data. Addresses start with /api/v1 after this site's address.
Addresses for today
| Method | Address | What it does | Status codes |
|---|---|---|---|
| GET | /api/v1/secure/basic | Basic authentication: user student, password Learn@123 | 200 OK, 401 Unauthorized |
| POST | /api/v1/auth/token{"username": "student", "password": "Learn@123"} | Log in with JSON and get a bearer token (valid for one hour) | 200 OK, 400 Bad request, 401 Unauthorized |
| POST | /api/v1/oauth/token | OAuth 2 client credentials. Form fields: grant_type=client_credentials, client_id=lab-client, client_secret=lab-secret | 200 OK, 400 Bad request, 401 Unauthorized |
| GET | /api/v1/secure/bearer | Needs the header Authorization: Bearer <token> | 200 OK, 401 Unauthorized |
| GET | /api/v1/secure/apikey | Needs the header X-API-Key: lab-key-123. Missing = 401, wrong = 403 | 200 OK, 401 Unauthorized, 403 Forbidden |
| POST | /api/v1/users/{id}/orders{"product": "Webcam", "quantity": 2} | Create an order for a user: product and quantity (1 to 10; a sandbox holds at most 200 orders) | 201 Created, 400 Bad request, 404 Not found, 409 Conflict |
| DELETE | /api/v1/users/{id}/orders/{orderId} | Delete an order | 204 No content, 400 Bad request, 404 Not found |