Authentication

The API's provided by IAG's API Platform use the OAuth 2.0 for authentication.  An access token must be included in each request to access a resource.  Client credentials authorisation flow is used to obtain an access token to authorise API requests.  This authorisation flow is best suited for server side applications.  Access tokens have a limited lifetime, and expire after "one hour".  The client application simply requests a replacement access token once the current token expires.

Remember, your application must be capable of securely storing the application credentials required for the client credentials authorisation flow.

Example:

The flow for client credentials authorisation is:

  1. Request an access token from the API token endpoint
  2. Extract the access token from the response

 

Request an access token

Your application requests a token from the API. The OAuth token exchange endpoint is https://api.iag.com.au/v1/oauth/token and the token request is made using an HTTPS request with the conditions:

    the method must be POST
    the body contains the following parameters: grant_type, api_key, api_secret

Important: your application must store the application secret value securely and must not expose the value to any users. If necessary, you can reset the secret for your application using the My Applications Page in the Developer Portal.

Example

$ curl "https://api.iag.com.au/v1/oauth/token" \

  --request POST \
  --header "Content-Type: application/x-www-form-urlencoded" \
  --data "api_key=some_key" \
  --data "api_secret=some_secret"
  --data "grant_type=client_credentials"

 

Extract the access token

A successful response from the token request in the previous stage is JSON format data containing the access token. Your application parses the JSON to extract the OAuth access token.

{
    "access_token": "35a31216-f575-664f-8e90-d51a8d6ec9ac",
    "token_type": "bearer",
    "expires_in": 3600
}

Note: Client credentials flow does not provide long lived tokens and hence Refresh Token is not part of the above Response.

 

Sandbox Testing

Sandbox environment uses the same application credentials (API key/secret), but with different endpoints. Applications should be tested on the Sandbox environment before rolled out to production. To test in the Sandbox environment, use the Sandbox endpoints and the Sandbox test user data.

Example:

curl "https://api-sandbox.iag.com.au/v1/home-insurance/estimate" \
 --header "Accept: application/json" \
 --header "Content-Type: application/x-www-form-urlencoded" \
 --header "Authorization: Bearer 35a31216-f575-664f-8e90-d51a8d6ec9ac" \
 --request POST

NOTE: the above is an example request using the IAG Home-Insurance API on the IAG Sandbox environment.  Replace "sandbox.iag.com.au/v1/home-insurance/estimate" with the URI and path of the environment and API that you have been given access to.

Next read about IAG's Standard API Parameters