API protocol: HTTPS
Response data format: JSON
Character encoding: UTF-8
The APIs support the POST method.
Encoding format: UTF-8
POST content type: application/json;charset=UTF-8, application/x-www-form-urlencoded
If the content-type field is not set to application/json, the APIs may fail to be called in some cases.
The API response may include additional fields in the future.
Authentication information is specified based on the request header. The token is in JWT format.
Authorization: Bearer <Token in JWT format>
The language information is specified by Accept-Language in the request header. The value is a standard locale.
Cipher Suites
| TLS Version | Cipher Suite (IANA Name) |
|---|---|
| TLS 1.3 | TLS_AES_128_GCM_SHA256 TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 |
| TLS 1.2 | TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 |
Certificate Verification
If the certificate on the server side is not verified or is tampered with, the client may connect to an unexpected server. This will cause security issues like man-in-the-middle attacks and data leakage. To ensure connection security, it is necessary for your server to verify the certificate provided by the IAP server, when your server accesses the IAP server. The verification consists of two parts: first, check whether the certificate is from a trusted source; second, check whether the IAP server provides the correct certificate.