Signing Vembu BDR API request with signature

This section describes how to create signature and add it to a Vembu BDR API request.

Below example illustrates, how an API request might looks like:

Summary of Signing Steps

To create a signed request, complete the following.

Task 1 : Create a API request

Task 2 : Create a Secret Key

Task 3 : Create a signature for the API request

Task 4 : Add the signature information to the API request

Create a API request

Create API request in a standardized format, this ensure that when Vembu BDR receives API request, it calculate the same signature that you have calculated.

Follow the steps here to create API request, otherwise request calculated by you and request created by Vembu BDR won’t get matched and request will get denied.

API standardized format

Example API request

Start with the HTTP request method, (GET, PUT, POST, etc.)

VembuBDR uses POST request method for all API calls and the POST data should be in JSON format.

The Endpoint URL structure for the requests to be made is as follows:

http://machine_name(or)machine_ip:port/bdrwebservices.php

Query String Parameters

Pseudocode for deriving a Secretkey

To create the secretkey,  concatenate algorithm and login time as shown in the following format.

Following example shows how to construct secretkey

To create Secretkey

1. Start’s with algorithm, This value is the hashing algorithm that we used to calculate the md5 of VembuBDR application password,

2. The login time value is calculated from the GMT Time Value and is rendered as, 'Unix' number.

    3.  Append algorithm value with login time value to create Secretkey.

Create the signature for the API request

Signature is the process of adding authentication information to VembuBDR API request.

Before you calculate the signature, make sure you have created secret key specified at step 2, deriving secret key is specific to the login time which will add extra protection to the API request.

Pseudocode for deriving a signature

The following example shows the resulting signature if you use the same secret key and action name LIST_BACKUPS followed in this document.

Add the signature information to the API request

After you calculate the signature, final thing you need to do is adding it to HTTP header named “Signature”

Following examples shows a finished API request.

How Signature works?

1. Create an API request.
2. You can use your application password along with login time to derive your signkey(Secret Key).
3. You can use your API action name and signkey(secretkey) to create a signature.
4. You can add this signature to API request in header or query string parameter.

When VembuBDR server receives any API request, it will applies the same algorithm which you have used to generate the signature, if the signature matches then request will get processed otherwise request will get denied.