Connect to Back Office API
In order to communicate with the Back Office API, the API Consumer needs to attach a bearer token with every request. This token contains the necessary information that the API needs in order to appropriately route requests.
Obtain a Token
To obtain a token, send an HTTPS POST request to the Authentication Service using a Basic Authorization header containing the RTIconnect User and password. The supplied RTIconnect User affects the accessible stores in the RTIconnect API.
Note: it is the responsibility of the client to create and manage their RTIconnect User and password in their client domain.
To obtain a token:
In the upper-right of the Postman window, select the plus (+) to create a new request.
Copy the following snippet of code:
curl --location --request POST 'https://qc-auth-xconnect-rti.xenialdev.net/auth/v2/token' \ --header 'Authorization: Basic xxxx' \ --header 'Content-Type: application/json' \ --data-raw '{ "grantType": "token", "ClientId" : "xxx" }'In Postman, select File.
Select Import.
At the top of the window, select Raw Text.
In the raw text box, paste the snippet of code copied in Step 2.
Select Continue.
Change the imported URL to https://qa-xconnect.xenial.com/auth/v2/token.
In Postman, select Body.
Update the ClientID to the appropriate ClientID.
Select Authorization.
Change the Authorization Type to BasicAuth.
Type the username as <domain>.<username> and then type the password.
Select Send.
A token is returned.
Make the API Call
Once a token is generated through the Obtain a Token procedure, this section details how to make the actual API call.
From Postman, copy the token. Do not include the beginning/ending quotation marks.
In Postman, select Authorization.
Select Bearer Token, then paste the token.
In a new window, navigate to Swagger, then copy the URL for the API.
In Postman, navigate to Params then paste the URL from Swagger to autofill.
Alternatively, type the required parameters.
Navigate to Headers then type in a KEY of BusinessEntityID, and the proper number in the Value column. Usually, this number is 1, but not always.
Tip
A Not Authorized message means:
The user credentials do not have permission to access the API or,
The ClientID is incorrect. To view the access available to a specific ClientID, reference ClientID Access List.
ClientID Access List
To obtain a list of the accessible endpoint roles of a ClientID token:
Copy the token to the clipboard.
Navigate to https://jwt.io/.
In the menu bar across the top of the screen, select Debugger.
In the Encoded text pane on the left, paste the token.
In the Decoded text pane on the right, view the accessible list.