Connecting and authenticating

All requests to the REST API must be authenticated. The REST API uses the standard HTTP Basic access authentication mechanism to authenticate REST requests. The same users are valid for REST or GUI access.

To log in to the REST API server, use the following request components:

• Header
  • Accept: application/json
  • Content-Type: application/json (if the request has a non-empty request body)
  • Authorization: <base 64 encoding of username and password>
• Operation:
  GET, PATCH, POST, or DELETE
• URI pattern:
  URI pattern for one of the requests listed in the Operation section.

Note

To avoid exposure to a cross-site request forgery (CSRF), requests other than GET require the DELL-EMCTOKEN header. Before issuing any REST call which changes the state of the object (such as POST, PATCH or DELETE), send a GET request to receive a CSRF token. Use the value of token from the response header that is obtained from the GET call as a header value in the subsequent calls for this session.

The server returns the following in response to a successful login:

• A 200 OK HTTP status code.
• auth_cookie header, which is required to authenticate all subsequent requests, unless you resubmit the user ID and password with each request. It is also required for logging out of the session.

Note

After the auth_cookie value is set, a browser automatically sets the cookie value for each request.

If the authentication fails, the server returns a 401 Unauthorized HTTP status code.