We use essential cookies for the website to function, as well as analytics cookies for analyzing and creating statistics of the website performance. To agree to the use of analytics cookies, click "Accept All". You can manage your preferences at any time by clicking "Cookie Settings" on the footer. More Information.

Cookie Settings
Only Essential Cookies
Accept All
MaterialsConsole

HMS Core

App Services
输入关键字搜索
HMS Core
AppGallery Connect
HUAWEI HiAI
CTRL+K

Overview

Last updated: 2024-10-29 05:58
Content overview

API protocol: HTTPS

Response data format: JSON

Data charset: UTF-8

  • The APIs support the GET, POST, and DELETE methods. Query operations use GET, and modification operations use POST and DELETE.
  • Encoding format: UTF-8
  • Post Content Type: application/json
  • Get Content Type: application/x-www-form-urlencoded
  • Authentication information is specified based on the request header. The details are as follows:
    • App-level access token: Authorization: Basic Base64(APPAT:atvalue)

      - Example: The app-level access token is thisIsAppAtValue, then APPAT:atvalue is APPAT:thisIsAppAtValue.

      Therefore, replace APPAT:atvalue in Base64(APPAT:atvalue) with "APPAT:thisIsAppAtValue" to generate value QVBQQVQ6dGhpc0lzQXBwQXRWYWx1ZQ==.

      The value of Authorization in the request header is as follows: Basic QVBQQVQ6dGhpc0lzQXBwQXRWYWx1ZQ==

    • No authentication information: No corresponding header.
  • The language information is specified by Accept-Language in the request header. The value is a standard locale.

(Optional) Signature Algorithm

To fortify server-side security, pass the SHA256WithRSA/PSS signature algorithm to relevant APIs of HUAWEI IAP. SHA256WithRSA/PSS is the recommended signature algorithm. The configuration is as follows:

  • Request: In the request header, set {"signatureAlgorithm":"SHA256WithRSA/PSS"} in HW-IAP-APPINFO.
  • Response: If the response body contains the signatureAlgorithm field, use this signature algorithm (at the same level as the signature) to verify the signature.
NOTE
  1. HW-IAP-APPINFO must be a JSON string.
  2. signatureAlgorithm in HW-IAP-APPINFO can only be SHA256WithRSA/PSS.

Site Information

Expand

Service

Site Information

Order

China: https://orders-drcn.iap.cloud.huawei.com.cn

Germany: https://orders-dre.iap.cloud.huawei.eu

Singapore: https://orders-dra.iap.cloud.huawei.asia

Russia: https://orders-drru.iap.cloud.huawei.ru

Subscription

China: https://subscr-drcn.iap.cloud.huawei.com.cn

Germany: https://subscr-dre.iap.cloud.huawei.eu

Singapore: https://subscr-dra.iap.cloud.huawei.asia

Russia: https://subscr-drru.iap.cloud.huawei.ru

Cipher suites:

Expand

TLS Version

Cipher Suite (IANA Name)

Remarks

TLS 1.3

TLS_AES_128_GCM_SHA256

TLS_AES_256_GCM_SHA384

TLS_CHACHA20_POLY1305_SHA256

Now, the Russia site still uses TLS 1.2, instead of TLS 1.3. Certainly, TLS 1.3 will be supported in the future.

TLS 1.2

TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256

TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384

TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256

   
NOTE
  1. There are security vulnerabilities (such as CVE-2012-1870, CWE-326, and CVE-2011-3389) in TLS versions earlier than 1.2 and CBC cipher suites. To ensure the security and functionality of your app, use TLS 1.2 or later. On top of this, use the cipher suites specified in the preceding table when your app uses HTTP to access HUAWEI IAP.
  2. The TLS versions and cipher suites currently in use are much more than those listed in the preceding table. For security purposes, HUAWEI IAP will end its support for any TLS version earlier than 1.2 or cipher suite not included in the table in April 2023. Please complete relevant configurations as required, to avoid that your app is blocked from accessing HUAWEI IAP.
  3. A cipher suite may have different names in different dependent libraries (such as OpenSSL and GnuTLS).

Site Selection

You need to select one from the four sites: Chinese mainland site, Germany site, Singapore site, and Russia site. Here are some suggestions about site selection:

  1. You are advised to select the nearest site to the location where your server is deployed, to obtain the order information as soon as possible. For example:

    If your server is in the Chinese mainland, access the Chinese mainland site through its domain name.

    If your server is in Asia, Africa, or Latin America, access the Singapore site through its domain name.

    If your server is in Russia, access the Russia site through its domain name.

    If your server is in Europe or North America, access the Germany site through its domain name.

  2. In principle, you can select any site, because the IAP server can route your request for obtaining the order information to the site where the information is stored, regardless of the site you select here. Make sure that the request is sent in application/json format.

Certificate Verification

If the certificate of the server is not verified or is tampered with, the client may connect to an unexpected server. This will cause security issues like man-in-the-middle attacks and data leakage. To ensure connection security, it is necessary for your server to verify the certificate provided by the Huawei IAP server, when your server accesses the Huawei IAP server.

The verification consists of two parts: First, check whether the certificate is from a trusted source. Second, check whether the Huawei IAP server provides the correct certificate.

English
©2026 HUAWEI Developers. All rights reserved.
Terms of Use
Statement About HUAWEI Developers and Privacy
Cookies
Cookie Settings
Open-Source Software Notice