When talking about API’s we often refer to Access and Authorisation.
- Access = connection, “can I get to the API layer?”
- Authorisation = permissions, “what can I do in the API layer?”
Iress manage these via their API Key Portal.
An Iress provisioned API Key (sometimes referred to as an App Key) will allow an integrator to connect their service to Xplan. One key can be used to connect to more than one Xplan site but suggested best practice would be to keep Dev/Test flow totally separate from Production flow. Additionally following the Principles of Least Privilege (PoLP) we advocate that keys are designated for a specific purpose which simplifies troubleshooting and reduces risk should the key become compromised.
Authorisation is managed primarily by capabilities, with one set attached to an API Key working in conjunction with those allocated to the Xplan User account connecting to the API.
In the image below the User has 6 capabilities attached to their Xplan user account, the Key has 4.
The result would be that while User 1 could access function A via the Xplan UI, if they attempted to perform the same action via an integration supported by Key 1 they would not be able to, as the only authorised resources would be the three listed in the intersection. Similarly, although the API Key is approved to access function ‘G’, User 1 would not be able to access it via the integration as they do not have the corresponding capability.
Before you can get connected to Xplan you need a key. To obtain a key you will need to talk to the local Iress Team who will be happy to discuss the best path forwards and any applicable commercial terms.
