API Security Login

[VarunGupta]

Hi,

To receive a session token id from RSA Archer, I'm calling its security login API and receiving "LoginNotValid" over HTTP 200 response. 

Could you please suggest if Username need to be part of specific Access Control Group or any other configuration required?

I'm trying to call RSA exposed login API via Postman.

HTTP POST  https://<hostname>/RSAarcher1/platformapi/core/security/login

HEADER:

Accept: application/json,text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8

Content-Type: application/json

BODY:

{
"InstanceName":"v6.6",
"Username":"xxxxxx",
"UserDomain":"",
"Password":"xxxxxx"
}

RESPONSE:

{

"Links": [],

"RequestedObject": null,

"IsSuccessful": false,

"ValidationMessages": [

{

"Reason": "Validation",

"Severity": 3,

"MessageKey": "ValidationMessageTemplates:LoginNotValid",

"Description": "",

"Location": -1,

"ErroredValue": null,

"Validator": "ArcherApi.Controllers.SecurityController, ArcherApi, Version=6.6.500.1044, Culture=neutral, PublicKeyToken=null",

"XmlData": null,

"ResourcedMessage": null

}

]

}

Please suggest.

Thank You,

Varun Gupta

[VarunGupta]

Okay.

Can't debate on what's been provided by RSA Archer "as its design" features.

Can you confirm on following, Please:

Are there specifications provided by RSA Archer to be shared with Consumer Application to hit the APIs endpoint with JSON payload/data matching that specification?

For example: for Data Feed, Data Feed Status, Content API, APIs for getting Module details.

[Ilya_Khen]

Well, user should have access to Manage DF, Manage Applications, reach Module - have Read access, etc.

[VarunGupta]

Thank You IIya. I think, "Access" to modules of RSA Archer is another pre-requisite to access APIs or get the response over APIs, that I don't see properly documented in APIs Documentations.

But that doesn't answer my previous questions of specification. "Are there Specifications/Definitions/Schema provided by RSA Archer to be shared with Consumer Applications to develop their application and hit the APIs endpoint with JSON payload/data matching that Specification/Definition/Schema?"

[Ilya_Khen]

These are shared in form of Guidelines you can find in standard location: 

RSA Archer Platform 6.7 

https://community.rsa.com/docs/DOC-97463 

[VarunGupta]

I have been referencing 'RSA Archer 6.5 RESTful API Reference Guide' for the APIs but this document does not provide or say anything about the specifications/definitions/schemas that can be used by Consumer Applications. Specification could be in JSON/YAML etc. formats.

Yes, it gives few examples but it doesn't say from where Specification/Definitions/Schemas can be retrieved to share it further with Consumer Applications, which can build their application accordingly and send/receive request/response matching to that specification(s).

Does that mean, I can assume that RSA Archer doesn't provide Specifications, officially?

[Ilya_Khen]

Well, I am not aware of anything else official. You can ask this by official channels via RSA Support.

Something also was provided by Jeff Letterman:

Archer API Templates - an Archer application to quickly test the Archer Web Services API, REST API, and Content API usin… 

[VarunGupta]

Sure, will do.

Thank You IIya for long conversation.

[BodieMinster]

The specifications, such as they are, are at the field level and are based on field type. If you are looking at the SOAP API, there are some detailed guidelines in the online help that will assist you in writing valid Field XML. For the Platform API, the exact format of the JSON is based on the field type. Many of the "simple" field types are just a value. For example, text, date, and numeric. It gets more complex with list-based types, which may contain an array of integers, or an array of complex types (as in the case of Cross References).

There is no published specification or schema that I am aware of, so I usually tell folks that are just getting started with Archer API development that retrieving a record is the most reliable way to see a valid record format.

[Ilya_Khen]

Anytime

[VarunGupta]

Thank You Bodie.