AppTrana API Access via Token-Based Authentication
AppTrana supports token-based authentication for programmatic access to its APIs. To get a token, you use an API key and an API secret. Create an API key and an API secret in the portal before you request a token. For the procedure, see How to create an API key.
Step 1: Generate Access Token
Get an access token
Send a POST request that contains the API key and the API secret. The response contains a Bearer token.
Endpoint
POST https://tas.indusface.com/wafportal/rest/userApiKey/serviceToken
Request (cURL)
curl -X POST 'https://tas.indusface.com/wafportal/rest/userApiKey/serviceToken' \
-H 'Content-Type: application/json' \
-d '{"api_key":"APT-AK-xxxxxxxx","api_secret":"APT-AS-xxxxxxxx","expires_in_hours":12}'Request fields
| Field | Type | Required | Notes |
|---|---|---|---|
| api_key | string | Yes | The API key from the portal (APT-AK-…). |
| api_secret | string | Yes | The API secret from the portal (APT-AS-…). |
| expires_in_hours | number | No | The token lifetime that you request, in hours. The token lifetime is the smallest of these three values: this field, the maximum lifetime of the API key, and 24 hours. |
Sample Response (200)
{
"message": "Token issued successfully",
"status": "SUCCESS",
"response": {
"token": "eyJ…",
"token_type": "Bearer",
"expires_in": 43200
}
}The expires_in value is in seconds. If the current token is still valid, a new request returns the same token.
The maximum token lifetime is 24 hours.
Error Response (401)
If the API key or the API secret is not correct, the API returns this response:
{ "message": "Invalid credentials", "status": "FAILED", "response": null }Make sure that the API key and the API secret are correct. Then send the request again.
Step 2: Use Token in API Requests
Once you receive the access token, pass it as a Bearer token in the Authorization header of your API requests.
Get All Websites
Use the below endpoint to get information about all the sites added to your account.
Endpoint:
GET https://tas.indusface.com/wafportal/rest/api/v1/websites
Request:
curl --request GET \
--url https://tas.indusface.com/wafportal/rest/api/v1/websites \
--header "Authorization: Bearer lpOtq1pRe0QgV5qvPaRDgRugBQrstYYv" \
--header "Content-Type: application/json" \
--data '{}'Example: Blacklist an IP
Endpoint:
POST https://tas.indusface.com/wafportal/rest/api/v1/ip-blocklist
Request:
curl --location "https://tas.indusface.com/wafportal/rest/api/v1/ip-blocklist" \
--header "Authorization: Bearer lpOtq1pRe0QgV5qvPaRDgRugBQrstYYv" \--header "Content-Type: application/json" \
--data '{
"websiteIds": [12345, 7373],
"ips": ["192.168.1.100"]
}'
- Keep your API ID and API Key confidential.
- You may reuse the token across APIs until it expires (~24 hours).
- If your IP is not allowed in the connector settings, authentication will fail.
For questions or feedback, please contact us at support@indusface.com