Login Flow

For authorization, we use HTTP basic authentication to authenticate and then give an access token to the APIs.

The access for a given application to various APIs and organisations at the moment cannot be managed by the end-user and are instead managed by the Enfore team. Similarly, application creation is managed by the Enfore team.

Once an application is created and has permissions for an organization, a secret key is generated.

Get Organisation specific access token 'org-access-token'

Calls to the authorize endpoint can be made via the Basic authorization scheme. For this, you will need to make a GET call to the /authorize endpoint with an Authorization header that contains the text Basic followed by Base 64 encoded app-name:secret pair.

For example, if your app-name is myapp and secret is mysecret, you will attach the header with value Basic bXlhcHA6bXlzZWNyZXQ= where bXlhcHA6bXlzZWNyZXQ= is the Base64 encoded string containing the text myapp:mysecret.

Now you can obtain an org-access-token for the organisation on behalf of which you would like to make calls to our APIs.

When the org-access-token expires, you can repeat the same process to get a new one. Here is an example call for the above request:

curl -X GET \
  https://external.apis.enfore.com/auth/authorize/<organisation-id> \
  -H 'Accept: */*' \
  -H 'Authorization: Basic <base64 encoded app-name and secret>'

The API will then respond with an org-access-token that is valid only for the given organisation ID of which was provided in the request (note: take a look at organisation-id variable in the path):

{
    "accessToken": <org-access-token>
}

Make API calls

Once you have an org-access-token (specific to the organisation), it can then be used to make the calls to an API via Bearer Authorization header.

Here is an example for the ERP invoices API (Note and must be filled in):

curl -X GET \
  "https://external.apis.enfore.com/erp/org/<organisation-id>/invoices?from=2019-02-13T00:04:00.000Z&to=2020-05-13T23:59:00.000Z&limit=10&offset=0" \
  -H 'Authorization: Bearer <org-access-token>'