Machine-to-Machine Authentication

Digital Identity Management provides the capability for partner systems to integrate with Digital Identity Management for a variety of automated tasks. Uses for these APIs include:

Provision Users and Accounts, in bulk, from external records into your Digital Identity Management data store.
Update/synchronization between Digital Identity Management and external systems (e.g. B/OSS systems).
Service entitlements and privacy management.

API Access

Partner systems access protected M2M APIs by including the {partner key}:{partner secret} in the X-Partner-AUTHZ header of each call. The key and secret are returned from Digital Identity Management when you provision a partner with POST /partners API. Certain M2M endpoints used as part of a MarketONE integration may alternatively be protected by a MarketONE Partner API key. These API keys are shared across MarketONE services (as an example, MarketONE Partner API keys obtained from PLM would also be functional with compatible Digital Identity Management endpoints). MarketONE Partner API keys can be presented to Digital Identity Management via the X-API-KEY header of each call. At present, the POST /runtime/event API is the only Digital Identity Management API supporting authentication via the MarketONE Partner API key. Note: M2M authentication methods are not interchangeable. Digital Identity Management APIs that require authentication using a MarketONE Partner API key will not accept any token provided via the X-Partner-AUTHZ header and vice versa. You must supply a valid authentication key matching the support M2M authentication method.

Example - POST /oidc/token

In the following example, a partner system invokes the POST /oidc/token API to request an access token. This example demonstrates the use of Digital Identity Management’s client credentials flow.

**REQUEST - URL**
POST https://~your.url/rest/{version}/oidc/token?client_id=XXXX&client_secret=XXXX&grant_type=client_credentials

Query Parameters

`client_id`	Specifies both the media type (of the content of the request body) that the client sends to the Digital Identity Management, as well as the media type (of the content of the response body) that Digital Identity Management returns to the client. Value must be: `Application/JSON`
`client_secret`	The Partner Key and Partner Secret, respectively.
`grant_type`	Value must be: `client_credentials`

Example - POST activation/user

In the following example, a partner system invokes the POST /activation/user API to provision a new Digital Identity Management User entity. This example demonstrates the use of Digital Identity Management’s core M2M authentication method via the AuthorizationX-Partner-AUTHZ header.

**REQUEST - URL**
POST https://~your.url/rest/{version}/activation/user

Headers

`Content-Type`	Specifies both the media type (of the content of the request body) that the client sends to the Digital Identity Management, as well as the media type (of the content of the response body) that Digital Identity Management returns to the client. Value must be: `Application/JSON`
`AuthorizationX-Partner-AUTHZ`	Bearer accessToken with correct m2m scope The Partner Key and Partner Secret, respectively. Base 64 encoding of: `\{Partner Key\}:\{Partner Secret\}`

**REQUEST - body**
{ 
   "displayName": "demo", 
   "emailAddress": "demo@test.com", 
   "username": "demo@test.com", 
   "type":"com.uxpsystems.mint.user.RegularUser" 
}

M2M Activation APIs

Digital Identity Management M2M APIs are stateless and do not require a user context. They use access tokens for authentication within the OIDC framework. ULM has special OIDC scopes for m2m access. Once cusomer configures OIDC client for m2m access with correct scopes the can use client_credentials OIDC flow to generate accessToken and use this token to access ULM m2m APIs Digital Identity Management allow customers to manage Digital Identity Management entities, and synchronize them with customer information in their own systems. The machine clients access these APIs to add or delete a user, and modify user attribute(s):

Delete a User by User Attibute (Machine-to-machine): DELETE /activation/user/byattribute/{attributeName}/{attributeValue}
Update a user by a specific attribute (Machine-to-machine): POST /activation/user/status/byattribute/{attributeName}/{attributeValue}
Add a user: POST /activation/addUser

See Connect Activation APIs used for more details. Parent topic:API Authentication

Home

Guides

APIs

API Access

Example - POST /oidc/token

Example - POST activation/user

M2M Activation APIs

​API Access

​Example - POST /oidc/token

​Example - POST activation/user

​M2M Activation APIs

API Access

Example - POST /oidc/token

Example - POST activation/user

M2M Activation APIs