Smart API is the name for RESTful web APIs developed and delivered by Hexagon PPM.
How Smart APIs are used
Software developers use Smart APIs to write custom software applications called Smart Clients. Smart APIs ensure a consistent development experience by following standards. Smart APIs are:
-
Consistent in pattern by supporting RESTful principles.
-
Consistent in operation by supporting the OData v4 protocol.
-
Secure by supporting the OAuth 2.0 protocol and OpenID Connect.
For more information on these standards and an overview of Smart Client development,
see Smart API Developer Documentation.
How access to Smart APIs is managed
Managing Smart APIs focuses primarily on security. Smart Clients must be able to call Smart APIs, but only if the identity of the user can be authenticated and authorized.
A Security Token Service (STS) is bundled with Smart API Manager and handles authorization for all requests to use a Smart API. The STS authenticates callers and validates identity against its own internal identity store, or by delegating to an external identity provider.
Smart API Manager supports Integrated Windows Authentication and Windows Credentials as external identity providers out-of-the-box. You can also configure custom external identity providers, such as Azure Active Directory and Active Directory Federation Services (ADFS).
So, Smart API Manager focuses on giving you the tools to manage and configure security concerns for Smart APIs. Smart API Manager lets you:
-
Register Smart APIs. A Smart API must be registered to be usable.
-
Create and manage groups, for example adding identities and specifying claims.
-
Authorize a group to access a Smart API.
-
Manage claims for a group, which are name/value pairs that allow you to control access to a Smart API at a more granular level.
-
Register Smart Clients. A Smart Client must be registered to call Smart APIs.