API Usage
The platform is equipped with the open API interface. Users can call HTTP/HTTPS for device management, data query, device command interaction and other operations, and build upper-level applications based on the API and individual needs.
API Authentication
In order to improve the security of API access, the API authentication parameters of OneNET are set as header parameters.
OneNET supports two authentication modes: normal and secure. The comparison is as follows:
| Normal | Secure (recommended) | |
|---|---|---|
| Core key | apiKey | accessKey |
| header parameter name | “api-key” | “Authorization” |
| header parameter value | apiKey (direct transmission key) | Token composed of parameter groups, without key |
| Access time control | Not Supported | Support (access time is controlled by the parameters in the parameter group) |
| Custom permission | Not Supported | Support (available in the near future) |
| Core key update | Not Supported | Support (available in the near future) |
| HTTPS | Supported | Supported |
| Security | Low | High |
Common authentication
apiKey is used as the authentication key in common authentication. It is divided into two access levels: product level (Master) and device level. | | Product level | Device level | | ------------------- | ------------------------------------------------------------ | ------------------------------------------------------------ | | Quantity | Unique under the product | More than one under the product | | Scope of permission | Operation of all resources under the product, including: device, data stream, data point, trigger, file, command and device apiKey | Full operation of some devices, including: device detail, device data stream, device data point | | Custom permission | Not Supported | Support the device level. Users need to associate the apiKey with device. Once they are associated, the maximum permission of the device will be available. |
Invoke Examples
(taking “API for retrieving device details” as an example)
GET /devices/3532392
api-key: WhI3aidfa82SUBD34h123hv1c=
Safe authorization
accessKey is used as the core key of security authentication. Users need to calculate the signature by the signature algorithm with the core key. The signature and other parameters constitute a token, which is used as a request header parameter for authentication.
Without direct transmission of the core key in the network during security authentication, the security of authentication can be enhanced by improving the time control of authentication parameters and adding the key permission granularity control (available in the near future), thus maximizing the access security.
See the security authentication chapter for details.
Invoke Examples
(taking “API for retrieving device details” as an example)
GET /devices/3532392
Authorization: version=2018-10-31&res=products%2F123123&et=1537255523&method=sha1&sign=ZjA1NzZlMmMxYzIOTg3MjBzNjYTI2MjA4Yw%3D