Calling RESTful web services - overview

Documentation home

See also: REST Web Service Resources, Using REST with the Programming API, REST Web Service Tutorial, Using OAuth Security

Ebase Xi provides two techniques for calling RESTful web services:

• Programming statements using the script API
• REST Web Service Resource

The main difference between these techniques is that with the programming option all configuration parameters are specified within the script code or are read from property files, whereas with the resource option all configuration is externalized and held in the resource. All supported functionality is available to both techniques so the choice of which technique to use is up to the individual developer. If you are comfortable with using Ebase Xi resources and the concept of mapping form fields to resource fields, then using resources is an obvious choice. If on the other hand you prefer to see all configuration parameters within program code then use the programming option. In general, it will be slightly faster to develop using the programming option. But if a target REST provider supports multiple endpoints, it may be easier (and tidier) to use a resource.

Security Options

Both techniques support four authentication techniques:

• Basic Authentication
• Digest Authentication
• NTLM Authentication
• OAuth Authentication

The first three are different variants of userid/password authentication and are relatively straightforward to implement.

OAuth authentication is a bit more complex and provides three distinct authentication techniques:

• Authorization Grant Access where the user authenticates by connecting to the 3^rd party system and signing on
• Resource Owner Password Credentials Grant Access where the Ebase Xi server does the signon on behalf of the user
• Client Credentials Grant Access where the Ebase XI server does not need any signon and it does not access user information

To use OAuth authentication, you first need to register your application with the 3^rd party provider who will then provide you with a client id and secret key. These details (and some others) are then used to create an OAuth Configuration using the Server Administration Application. Details on using OAuth can be found here, further information on OAuth in general is here.