API protocol: HTTPS
Response data format: JSON
Data charset: UTF-8
- The APIs support the GET, POST, and DELETE methods. Query operations use GET, and modification operations use POST and DELETE.
- Encoding format: UTF-8
- Post Content Type: application/json
- Get Content Type: application/x-www-form-urlencoded
- Authentication information is specified based on the request header. The details are as follows:
- App-level access token: Authorization: Basic Base64(APPAT:atvalue)
- Example: The app-level access token is thisIsAppAtValue, then APPAT:atvalue is APPAT:thisIsAppAtValue.
Therefore, replace APPAT:atvalue in Base64(APPAT:atvalue) with "APPAT:thisIsAppAtValue" to generate value QVBQQVQ6dGhpc0lzQXBwQXRWYWx1ZQ==.
The value of Authorization in the request header is as follows: Basic QVBQQVQ6dGhpc0lzQXBwQXRWYWx1ZQ==
- No authentication information: No corresponding header.
- App-level access token: Authorization: Basic Base64(APPAT:atvalue)
- The language information is specified by Accept-Language in the request header. The value is a standard locale.
(Optional) Signature Algorithm
To fortify server-side security, pass the SHA256WithRSA/PSS signature algorithm to relevant APIs of HUAWEI IAP. SHA256WithRSA/PSS is the recommended signature algorithm. The configuration is as follows:
- Request: In the request header, set {"signatureAlgorithm":"SHA256WithRSA/PSS"} in HW-IAP-APPINFO.
- Response: If the response body contains the signatureAlgorithm field, use this signature algorithm (at the same level as the signature) to verify the signature.
- HW-IAP-APPINFO must be a JSON string.
- signatureAlgorithm in HW-IAP-APPINFO can only be SHA256WithRSA/PSS.
Site Information
Service | Site Information |
|---|---|
Order | China: https://orders-drcn.iap.cloud.huawei.com.cn Germany: https://orders-dre.iap.cloud.huawei.eu Singapore: https://orders-dra.iap.cloud.huawei.asia Russia: https://orders-drru.iap.cloud.huawei.ru |
Subscription | China: https://subscr-drcn.iap.cloud.huawei.com.cn Germany: https://subscr-dre.iap.cloud.huawei.eu Singapore: https://subscr-dra.iap.cloud.huawei.asia Russia: https://subscr-drru.iap.cloud.huawei.ru |
Cipher suites:
TLS Version | Cipher Suite (IANA Name) | Remarks |
|---|---|---|
TLS 1.3 | TLS_AES_128_GCM_SHA256 TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 | Now, the Russia site still uses TLS 1.2, instead of TLS 1.3. Certainly, TLS 1.3 will be supported in the future. |
TLS 1.2 | TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 |
- There are security vulnerabilities (such as CVE-2012-1870, CWE-326, and CVE-2011-3389) in TLS versions earlier than 1.2 and CBC cipher suites. To ensure the security and functionality of your app, use TLS 1.2 or later. On top of this, use the cipher suites specified in the preceding table when your app uses HTTP to access HUAWEI IAP.
- The TLS versions and cipher suites currently in use are much more than those listed in the preceding table. For security purposes, HUAWEI IAP will end its support for any TLS version earlier than 1.2 or cipher suite not included in the table in April 2023. Please complete relevant configurations as required, to avoid that your app is blocked from accessing HUAWEI IAP.
- A cipher suite may have different names in different dependent libraries (such as OpenSSL and GnuTLS).
Site Selection
You need to select one from the four sites: Chinese mainland site, Germany site, Singapore site, and Russia site. Here are some suggestions about site selection:
- You are advised to select the nearest site to the location where your server is deployed, to obtain the order information as soon as possible. For example:
If your server is in the Chinese mainland, access the Chinese mainland site through its domain name.
If your server is in Asia, Africa, or Latin America, access the Singapore site through its domain name.
If your server is in Russia, access the Russia site through its domain name.
If your server is in Europe or North America, access the Germany site through its domain name.
- In principle, you can select any site, because the IAP server can route your request for obtaining the order information to the site where the information is stored, regardless of the site you select here. Make sure that the request is sent in application/json format.
Certificate Verification
If the certificate of the server is not verified or is tampered with, the client may connect to an unexpected server. This will cause security issues like man-in-the-middle attacks and data leakage. To ensure connection security, it is necessary for your server to verify the certificate provided by the Huawei IAP server, when your server accesses the Huawei IAP server.
The verification consists of two parts: First, check whether the certificate is from a trusted source. Second, check whether the Huawei IAP server provides the correct certificate.