Documentation
    {{docApp.userSession.userId}}
    {{docApp.userSession.userName}}
    {{docApp.userSession.email}}
    Issuer : {{docApp.userSession.issuerInstance}}
    Expires : {{new Date(docApp.userSession.validUntil).toLocaleDateString()}}

{{docApp.title}}

{{docApp.description}}

How can we help?

{{docApp.searchError}}
{{product.name}}

Searching in {{docApp.searchFilterBySpecificBookTitle}}

{{docApp.searchResultFilteredItems.length}} results for: {{docApp.currentResultsSearchText}} in {{docApp.searchFilterBySpecificBookTitle}}
Search results have been limited. There are a total of {{docApp.searchResponse.totalResultsAvailable}} matches.

You have an odd number of " characters in your search terms - each one needs closing with a matching " character!

{{docApp.libraryHomeViewProduct.title || docApp.libraryHomeViewProduct.id}}

{{docApp.libraryHomeViewProduct.description}}

  1. {{book.title}}

{{group.title || group.id}}

{{group.description}}

  1. {{book.title}}

{{group.title}}

{{book.title}}
More...

Security & Authentication

  • Article
  • 1 minutes to read

The Hornbill Platform has a comprehensive security model that is applied to all and any API calls. It is important to understand the security model and how it impacts what you can and cannot do with any API calls you make.

You should read the following topics before continuing.

API Key

For making API calls you should use an API Key. API Keys are created as an administrator against a specific user account. Once you have created a valid API key, you can make API calls without the need to establish an interactive session; instead you simply include the API key as a property of your API request payload. Behind the scenes, when using an API key, the platform will allocate and cache a temporary session, bound to your API key. Each time you make an API call, the API key is used to recover the cached session state.

Using API Keys

When making an API call, you send the API Key as part of the HTTP request header, specifically using the Authorization header sening a Bearer token.

To send the API key to the server as an Authorization header, the header value will be make up of the authorization token identifier ESP-APIKEY followed by a space, then followed by the-api-key-value.

See the following example…

POST /the/api/endpoint HTTP/1.1
Authorization: ESP-APIKEY the-api-key-goes-here
...other headers...

{
  "@service": "session",
  "@method": "getSessionInfo",
  "params": {
    ...
  }
}
  • Version {{docApp.book.version}}
  • Node {{docApp.node}} / {{docApp.build}}
In This Document