This signature algorithm is only applicable for API call

OMS4 Open API verifies the identity of each API request, and the application will also verify whether the call parameters are valid. Therefore, each HTTP request must contain the signature information. The requests with invalid signature will be rejected directly.

OMS4 Open API verifies the identity of the requests by the API Key and API Secret that are generated and issued by OMS4 System (Sales Channel, Fulfillment Point API Settings UI) . The API Secret is used to generate the signature string in the HTTP request URL and server-side signature string. It must be kept strictly confidential.

*Notes: UI layout maybe not up to date.

To generate Signature, you need to understand the following signature algorithm.

The process of generating the signature is as follows:

Example Request:

Common Parameters：
tenant_id=1001
api_key=2001
timestamp=1517820392000
singature=aa6c8cc1a72497a4cd2f6ae9916ee576095cfc798df84f97a6ad51227937aee0

Request Parameters:
foo=1
bar=2
foo_bar=3
foobar=4

Sort all request parameters (including common parameters[request header] and request parameters[request parameters], but except the “signature” parameter) according to the parameter name in ASCII table. For example:

Before sorting: 

tenant_id=1001
api_key=2001
timestamp=1517820392000
foo=1
bar=2
foo_bar=3
foobar=4

After sorting: 

api_key=2001
bar=2
foo=1
foo_bar=3
foobar=4
tenant_id=1001
timestamp=1517820392000

Concatenate the sorted parameters and their values into a string.

api_key2001bar2foo1foo_bar3foobar4tenant_id1001timestamp1517820392000

Add the API name in front of the concatenated string. For example, adding the API name “/rest/foo”:

/rest/fooapi_key2001bar2foo1foo_bar3foobar4tenant_id1001timestamp1517820392000

Notes: if POST request with request body (without request parameters), just append request body as string into the end of string.

Encode the concatenated string in UTF-8 format and make a digest by the signature algorithm (using HMAC_SHA256). For example:

hmac_sha256(/rest/fooapi_key2001bar2foo1foo_bar3foobar4tenant_id1001timestamp1517820392000)

Convert the digest to hexadecimal format. For example:

hex("hmacresult".getBytes("utf-8")) = "aa6c8cc1a72497a4cd2f6ae9916ee576095cfc798df84f97a6ad51227937aee0"