Common definitions

Authentification

The hizi.io Server (Backend) authenticates calls from the operator server with HTTP request header fields.

HTTP request header fields sent

X-H-AUTH-ID Operator ID

X-H-AUTH-SIG Signature of the payload (for details, see Signing payloads)

X-H-TIMESTAMP A timestamp in ISO_8601 format

The operator server authenticates calls from the hizi.io Server (Backend) with HTTP request header fields.

HTTP request header fields sent

X-H-AUTH-ID Operator ID

X-H-AUTH-SIG Signature of the payload (for details, see Signing payloads)

X-H-TIMESTAMP A timestamp in ISO_8601 format

Signing payloads

You need a secret to sign requests. To get this secret, log in to the hizi.io backoffice with your credentials. The signature is a base 64 encoded sha256 HMAC digest of a defined set of request parameters. This method lets you share the secret without including it in the request. You must also provide a timestamp as a request header field. Include this timestamp in the signature. Concatenate the fields with a hash character (#) before you calculate the sha256 HMAC.

The request always sends the signature in the request header field X-H-AUTH-SIG. For an example implementation of signature creation, log in to the hizi.io backoffice and look at the sample code provided.