# US 11,122,048 B2 · User profile access from engaging applications with privacy assurance associated with an API > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,122,048 B2 - Document ID: US11122048B2 - Status: Granted - Kind: B2 - Application number: 16/142,397 - Filed: 2018-09-26 - Published: 2020-03-26 - Granted: 2021-09-14 - Earliest claimed: 2018-09-26 - Assignees: International Business Machines Corporation - Applicants: International Business Machines Corporation - Inventors: Ben Z. Akselrod; Gal A. Shachor; Anton Aleksandrov; Moty Drimer; Nitzan Nissim - Web page: https://patentgrep.com/patent/US11122048B2 ## CPC - H04L 63/0807: {using tickets, e.g. Kerberos (cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213)} - H04L 63/102: {Entity profiles} - H04L 63/083: {using passwords (cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226)} - H04L 63/107: {wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals} - H04L 67/02: based on web technology, e.g. hypertext transfer protocol [HTTP] - H04W 12/06: Authentication - H04W 12/63: Location-dependent; Proximity-dependent - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract An approach to secure API access for distinct types of users. A request for access to an API from a user is initiated and followed by sending a request for a login credential to the user based on a type of API requested: Data API or Interaction API. The login credential is received along with the network location of the user. Authenticating the login credential and create an API specific token. Assigning the API specific token to a user activity and granting the user access to the specific API. ## Claims ### Claim 1 A computer implemented method for allowing API access for different types of users to an application, the computer implemented method comprising: receiving, by one of more processors, a request for access to an API (Application Programming Interface) from a user; sending, by the one of more processors, a request for a login credential to the user based on a type of API requested; receiving, by the one of more processors, the login credential from the user; authenticating, by the one of more processors, the login credential, further comprises: receiving, by the one of more processors, a network location associated with the user; receiving, by the one of more processors, the login credential; validating, by the one of more processors, both the login credential and the network location; determining, by the one of more processors, whether the received network location of the user is associated with a highly secured network location, wherein the highly secured network location is one of a company VPN (virtual private network) and a company intranet network; responsive to determining the network location of the user is located on the highly secured network location, the user has access to an admin ACL (access control list) and the login and password is valid, assigning, by the one of more processors, a Data API token to the user, wherein the Data API token further comprises of a first REST (Representation Sate Transfer) API that has been configured to allow the user access only to administrator-related attributes of the application and the Interaction API token further comprises of a second REST API that has been configured to allow the user access to only client-related transactions of the application; and responsive to determining the network location of the user is not located on the highly secured network location, the user has access to a client ACL (access control list) and the login and password is valid, assigning, by the one of more processors, an Interaction API token to the user; and granting, by the one of more processors, the user access to the API based on the API token. ### Claim 2 (depends on 1) The method of claim 1, wherein the API comprises a data API and an interaction API. ### Claim 3 (depends on 1) The method of claim 1, wherein receiving the network location associated with the user further comprises: determining, by the one of more processors, an IP (Internet Protocol) address of the user; determining, by the one of more processors, a domain name associated with the user; and determining, by the one of more processors, a cookie associated with the user's browser. ### Claim 4 (depends on 1) The method of claim 1, wherein the administrator-related attributes further comprises of access to customer-sensitive data and wherein the client-related transactions further comprises of picking a seat preference and storing credit card information. ### Claim 5 (depends on 1) The method of claim 1, sending a request for a login credential to the user further comprising: transmitting, by the one of more processors, a request to a mobile device of the user; and transmitting, by the one of more processors, the request to a client computing device of the user. ### Claim 6 (depends on 1) The method of claim 1, wherein the predetermined network location further comprises a highly secured network location and a public network location. ### Claim 7 A computer program product for allowing API access for different types of users to an application, the computer program product comprising: one or more computer readable storage devices and program instructions stored on the one or more computer readable storage devices, the stored program instructions comprising: program instructions to receive a request for access to an API (Application Programming Interface) from a user; program instructions to send a request for a login credential to the user based on a type of API requested; program instructions to receive the login credential from the user; program instructions to authenticate the login credential, further comprises: program instructions to receive a network location associated with the user; program instructions to receive the login credential; and program instructions to validate both the login credential and the network location; program instructions to determine whether the received network location of the user is associated with a highly secured network location, wherein the highly secured network location is one of a company VPN (virtual private network) and a company intranet network; responsive to determining the network location of the user is located on the highly secured network location, the user has access rights to an admin ACL (access control list) and the login and password is valid, program instructions to assign a Data API token to the user, wherein the Data API token further comprises of a first REST (Representation Sate Transfer) API that has been configured to allow the user access only to administrator-related attributes of the application and the Interaction API token further comprises of a second REST API that has been configured to allow the user access to only client-related transactions of the application; and responsive to determining the network location of the user is not located on the highly secured network location, the user has access rights to a client ACL (access control list) and the login and password is valid, program instructions to assign an Interaction API token to the user; program instructions to grant the user access to the API based on the API token. ### Claim 8 (depends on 7) The computer program product of claim 7, wherein program instructions to receive the network location associated with the user further comprising: program instructions to determine an IP (Internet Protocol) address of the user; program instructions to determine a domain name associated with the user; and program instructions to determine a cookie associated with the user's browser. ### Claim 9 (depends on 7) The computer program product of claim 7, wherein the administrator-related attributes further comprises of access to customer-sensitive data and wherein the client-related transactions further comprises of picking a seat preference and storing credit card information. ### Claim 10 (depends on 7) The computer program product of claim 7, wherein, program instructions to send a request for a login credential to the user further comprising: program instructions to transmit a request to a mobile device of the user; and program instructions to transmit the request to a client computing device of the user. ### Claim 11 (depends on 7) The computer program product of claim 7, wherein the API comprises a data API and an interaction API. ### Claim 12 (depends on 7) The computer program product of claim 7, wherein the predetermined network location further comprises a highly secured network location and a public network location. ### Claim 13 A computer system for allowing API access for different types of users to an application, the computer system comprising: one or more computer processors; one or more computer readable storage devices; program instructions stored on the one or more computer readable storage devices for execution by at least one of the one or more computer processors, the stored program instructions comprising: program instructions to receive a request for access to an API (Application Programming Interface) from a user; program instructions to send a request for a login credential to the user based on a type of API requested; program instructions to receive the login credential from the user; program instructions to authenticate the login credential, further comprises: program instructions to receive a network location associated with the user; program instructions to receive the login credential; and program instructions to validate both the login credential and the network location; program instructions to determine whether the received network location of the user is associated with a highly secured network location, wherein the highly secured network location is one of a company VPN (virtual private network) and a company intranet network; responsive to determining the network location of the user is located on the highly secured network location, the user has access rights to an admin ACL (access control list) and the login and password is valid, program instructions to assign a Data API token to the user, wherein the Data API token further comprises of a first REST (Representation Sate Transfer) API that has been configured to allow the user access only to administrator-related attributes of the application and the Interaction API token further comprises of a second REST API that has been configured to allow the user access to only client-related transactions of the application; and responsive to determining the network location of the user is not located on the highly secured network location, the user has access rights to a client ACL (access control list) and the login and password is valid, program instructions to assign an Interaction API token to the user; program instructions to grant the user access to the API based on the API token. ### Claim 14 (depends on 13) The computer system of claim 13, wherein program instructions to receive the network location associated with the user further comprising: program instructions to determine an IP (Internet Protocol) address of the user; program instructions to determine a domain name associated with the user; and program instructions to determine a cookie associated with the user's browser. ### Claim 15 (depends on 13) The computer system of claim 13, wherein the administrator-related attributes further comprises of access to customer-sensitive data and wherein the client-related transactions further comprises of picking a seat preference and storing credit card information. ### Claim 16 (depends on 13) The computer system of claim 13, wherein, program instructions to send a request for a login credential to the user further comprising: program instructions to transmit a request to a mobile device of the user; and program instructions to transmit the request to a client computing device of the user. ### Claim 17 (depends on 13) The computer system of claim 13, wherein the API comprises a data API and an interaction API.