This document will give an overview of the API integrations that the Ideagen has built in order to help its clients to integrate seamlessly with the product across different EHS Modules like Incident Management, Audits, Learning Management, Sustainability , BBS etc. It contains descriptions and example messages sent over HTTPS between the client and Ideagen end points.

There are examples of request and response messages for the purposes of understanding the working nature of each of the service calls.

REST APIs provide an industry standards-based, cross platform, flexible mechanism for
integrating Ideagen EHS functionality into third-party applications and business processes.

Messages are sent using the standard formats and protocols used to build the World Wide Web, so
provide great opportunities to build applications on any platform that supports these standards.

The standard message exchange format for Ideagen API is JSON.

Usage :

The customers can utilize the API offerings to extract data which can be utilized further for several data analytics.

Please note that this token expires every 2 hours(configurable) so in order to make the next call, the token needs to be generated again by calling the Authentication endpoint.

There are basic few prerequisites in order to set use Ideagen’s EHS API’s to extract data :

i. ConsumerId- this is a unique ID for each consumer which Ideagen provides.

ii. API URL Details - this is URL for each API wrt UAT and Production environments.

iii. Credentials - this is User credentials that will be provided by Ideagen team to customer team, which will be used for token based authentication.

Below are some of the common error codes /validation messages .

a. Communication Problems
The first step to debugging any problem with the Ideagen Services is to make sure you can connect to them. The easiest way to do this is by making sure you can request the homepage of one of the service endpoints. This can be achieved by entering the URL into a Web browser e.g. http://integrationsvc.processmap.com/outbound
If there is no meaningful response , make sure you used the correct URL. If you are sure you used the correct URL, then reach out to Ideagen team with the error message.

i. Missing Parameter :

All mandatory parameters defined in the detailed documentation for each endpoint must be passed ,in the mentioned format only, otherwise “Missing required header <_____>” error message would be displayed.

ii. Misspelt element :

The parameter name should be passed as mentioned in detailed documentation, and any deviations would result in error. For example - if the correct parameter is <username> and <usrname> is passed by the user then it would not generate response , error message “Invalid parameter” would be displayed.

ii. Invalid date range :

The detailed documentation describes in detail the date range criteria for which the API will pull the data , if any range passed is beyond permissible limit then “Data can be pulled only for ___ years” error message would be displayed.

All Ideagen API Calls are secured with Token based authentication, The user credentials are not transmitted over multiple API endpoint calls, rather it works only after the JWT Token gets generated at the first step. The JWT token is encrypted , and it is generated as per the RS256 Algorithm. The calls are made over HTTPS Protocol.

API Security Controls

▪ Jail Safety Mechanisms enforced to handle authentication flood attempts

▪ RBAC (Role Based Access Control) , ACLs (Access Control Lists) is being designed

▪ JWT Authentication: Strong authentication and authorization solution.

▪ Used rate limiting and limit payload size to prevent denial-of-service attacks on API endpoints.

Additional Controls:

▪ Web application firewall.

▪ Supports communication channel TLS 1.2 & above.

▪ Mechanism to handle Distributed denial-of-service (DDoS) attacks at network level.

The Outbound APIs are enhanced and modified time to time with respect to each version according to the enhancements in the product. As and when the module functionality is added, the changes are incorporated in the APIs.

The customers using the API Services are communicated prior, about the change.