To generate a new access token, you issue a token API call with the above parameters where grant_type=password. The Token API then returns two tokens: an access token and a refresh token. The access token can then be stored in a session on the client side (the application itself does not need to manage users and passwords). On the API Gateway side, the access token is validated for each API call. When the token expires, you refresh the token by issuing a token API call with the above parameters where grant_type=refresh_token and passing the refresh token as a parameter.
Creating users and roles
In section , we introduced you to a set of users that are commonly found in many enterprises. To create these users in the API Manager, you log in to the management console as an administration user (credentials: admin/admin). The admin use can play the creator, publisher and subscriber roles described earlier. In this section, we explain how to set up these users or custom users and roles.
- Log in to the management console (https://hostname:9443/carbon) using admin/admin credentials.
- Select the Users and Roles menu under the Configure menu.
- Click Add New Role and provide
creatoras the role name.
- Click Next.
- Select the following permissions from the list that opens and click Finish.
- Manage > API > Create
- Manage > Resources > Govern and all underlying permissions
Similarly, create the
publisherrole with the following permissions.
- Manage > API > Publish
- You can now create users for each of those roles. To do so, click the Users and Roles menu under the Configure menu.
- Click Users.
- Click Add New User, provide the username/password and click Next.
- Select the role you want to assign to the user (e.g.,
subscriber) and click Finish.
- Repeat the steps to create at least one user for all roles.
Creating and publishing APIs
An API creator uses the API provider Web application to create and publish APIs into the API Store. In this section, we explain how to create an API and attach documentation to it.
The Phone Number Validation API
Along this guide, we work with a service exposed by the Cdyne services provider (www.wdyne.com). We use their phone validation service, which has SOAP and REST interfaces and is documented using a WSDL file. This service is documented at : http://wiki.cdyne.com/index.php/Phone_Verification.
Let's create this API and add it to the API Store.
- Open the API Publisher (https://<YourHostName>:9443/publisher) and log in a
Login using the user in creator role you defined previously (in our case, apicre