Method and apparatus for securely invoking a rest API

A non-transitory computer-readable storage medium storing instructions that when executed by a computer cause the computer to perform a method for enabling a user to securely invoke a REST (Representational State Transfer) API (Application Programmer Interface) at an application server, the method comprising:

• establishing a first secure communication channel with an application server;
• sending, from a client, a first request to the application server to invoke the REST API, wherein the first request is sent using the first secure communication channel;
• receiving a security token from an authentication system in response to authenticating the user with the authentication system;
• receiving a nonce and a timestamp from the application server, wherein the nonce is a pseudo-random number that is generated by the application server and the timestamp is the application server's system time;
• determining, at the client, a security token digest by combining the security token, the nonce, and the timestamp;
• sending, from the client, a second request to the application server to invoke the REST API, wherein the second request includes the security token digest and the first request, and wherein the second request is sent using the first secure communication channel;
• receiving data at the client from the application server which is associated with the request to invoke the REST API;
• and
• storing the data.

A method for enabling a user to securely invoke a REST (Representational State Transfer) API (Application Programming Interface) at an application server, the method comprising:

• establishing a first secure communication channel with a client;
• receiving a first request from the client to invoke the REST API, wherein the first request is received using the first secure communication channel;
• in response to receiving the first request, sending a nonce and a timestamp to the client, wherein the nonce is a pseudo-random number that is generated by the application server and the timestamp is the application server's system time;
• receiving a security token digest from the client;
• determining whether the security token digest is valid by validating the security token digest;
• upon determining that the security token digest is valid:
• generating output data by using data for the first request to invoke the REST API;
• and
• sending the output data to the client.

A non-transitory computer-readable storage medium storing instructions that when executed by a computer cause the computer to perform a method for enabling a user to securely invoke a REST (Representational State Transfer) API (Application Programming Interface) at an application server, the method comprising:

• establishing a first secure communication channel with a client;
• receiving a first request from the client to invoke the REST API, wherein the first request is received using the first secure communication channel;
• in response to receiving the first request, sending a nonce and a timestamp to the client, wherein the nonce is a pseudo-random number that is generated by the application server and the timestamp is the application server's system time;
• receiving a security token digest from the client;
• determining whether the security token digest is valid by validating the security token digest;
• upon determining that the security token digest is valid:
• generating output data by using data for the first request to invoke the REST API;
• and
• sending the output data to the client.