introduction

Introduction

Rules

Api is available at https://cloud.damnlist.com/mobile/v1 under this conditions:

• API always return JSON
• content_type = application/json
• authorization using HMAC
• enquiry GET i DELETE can have parameters
• every right answer contains {"status": "ok"}

Standard answers

Confirmation

{
    "status": "ok"
}

• always HTTP STATUS equails 200
• field status = "ok"

Error

{
    "status": "error",
    "error": "AccessDenied"
}

• error always has HTTP STATUS different than 200 (400,401,403,404,500)
• it's field status = "error"
• error field can have additional parameter

Authorisation

Authorisation use HMAC with calculated signature based on key public, asked and hashed with key private.

public key is sent in header X-public, with calculated signature in X-hmac.

Pair of keys PUBLIC and PRIVATE we're receving by a rule:

POST /login  
with parameters POST:  
login: with Damnlist login
password: Password

answers:

{
    "status": "ok",
    "user": {
        "public": "Your public key",
        "private": "Your private key",
        "date": {
            "date": "2016-05-30 13:29:12",
            "timezone_type": 3,
            "timezone": "Europe/Berlin"
        }
    }
}

Calculating a control sum of HMAC for GET and DELETE

X-hmac = hash_hmac('SHA1' ,PUBLIC+REQUEST_PATH+HTTP_PARAMS, PRIVATE)

np.

GET https://cloud.damnlist.com/mobile/v1/list/1/clients?q=test
PUBLIC = '12345asd'
PRIVATE = 'querty123'
X-hmac = hash_hmac('SHA1', '12345asd'+'/mobile/v1/list/1/clients?q=test', 'querty123')

Calculating a control sum of HMAC for POST and PUT

X-hmac = hash_hmac('SHA1', PUBLIC+REQUEST_PATH+HTTP_POST_JSON_BODY, PRIVATE)

np.

POST https://cloud.damnlist.com/mobile/v1/list/1/client/10/sale/77/details  
{"text": "test"}
PUBLIC = '12345asd'
PRIVATE = 'querty123'
X-hmac = hash_hmac('SHA1', '12345asd'+'/mobile/v1/list/1/client/10/sale/77/details'+{"text": "test"}, 'querty123')