Web API Authentication

RE: Web API Authentication

thevarunbawa — Thu, 07 Jul 2022 21:32:22 GMT

Thanks Peter Lewis, that helped.

RE: Web API Authentication

Peter Lewis — Wed, 06 Jul 2022 18:12:04 GMT

Yes the credentials are just the username + password for the user account. See this sample for a request that uses basic authentication: docs.appian.com/.../Web_API_Authentication.html

RE: Web API Authentication

thevarunbawa — Wed, 06 Jul 2022 14:49:32 GMT

Thanks Peter Lewis for the elaborate response. Just one confusion, for basic authentication, what are the credentials do we provide to client/requestor, is it we create a new basic user account for them in the environment and provide those creds to access or is it something else?

RE: Web API Authentication

Peter Lewis — Wed, 25 May 2022 20:39:37 GMT

Keep in mind that authentication for APIs really means two things:

Ensuring the request authenticates using a valid Appian account
Using Appian object level security to ensure that user has access to this Web API (and its precedent objects)

The reason that service accounts are needed for API keys is that all object-level security in Appian is configured using users + groups. So if someone authenticates using an API key, the user context used to evaluate whether they have access to the object or not is based on the service account.

As far as basic authentication, there's no configuration required in Appian to allow authenticating using basic auth - just provide the username and password as part of the request. There's no way to disable using basic authentication (that I'm aware of), but you can still disable it in all practical senses by limiting the security on your Web API to only users in the service accounts group. Then, there wouldn't be any users that could authenticate using basic authentication.

RE: Web API Authentication

Stefan Helzle — Wed, 25 May 2022 16:54:44 GMT

I highly recommend to read the documentation. It will answer most of your questions.

While you cannot disable an authentication method, when you create a service user and use the API key, basic auth will not work for this user.