1. REST API for Risk Service in Oracle Advanced Risk Manager
  2. Tasks
  3. User Session

Create session

post

https://oaainstall-host/risk-analyzer/session/v1

Creates new OARM session for the user authentication request.

Request

There are no request parameters for this operation.

Supported Media Types
Request Body - application/xml ()
Root Schema : schema
Type: object
Request object for creating the session
Show Source
Nested Schema : DeviceFingerprintDataList
Type: array
List of the device fingerprint data
Show Source
Nested Schema : IPData
Type: object
IP related data used during authentication
Show Source
  • The latitude of the location. Min value is -90 (negative values for sounthern hemisphere) and max value is +90 (positive values for northern hemisphere)
  • This attribute describes the accuracy of the location information (longitude, latitude pair). This attribute along with location accuracy units will indicate the accuracy. Typical example will be say within 2 meters of the indicated co-ordinates. For this example the value of this attribute will be 2.0 and the value of location accuracy type will be a enumeration pointing to metere.
  • Required when locationAccuracy is present. This attribute along with locationAccuracy attribute describes the accuracy of the location information (longitude, latitude pair). This attribute along with location accuracy units will indicate the accuracy. Typical example will be say within 2 meters of the indicated co-ordinates. For this example the value of this attribute will be a enumeration pointing to meter and value of locationAccuracy attribute will be 2.0.
  • Date time string in the format rfc3339 sec 5.6. https://tools.ietf.org/html/rfc3339#section-5.6 e.g format 2021-08-13T01:29:29.768Z
  • Required when locationAccuracy is present. This attribute indicates the type / method by which location was acquired. This is enumeration of the type location.source.type.enum. Some of the possible integer values will correspond to gps, asisted gps, wifi hotspot etc.
  • The longitude of the location. Min value is -180 (negative values for western hemisphere) and max value is +180 (positive values for eastern hemispehre).
  • This attribute is the proxy IP address of the session if proxy is present. (in A.B.C.D format)
  • This attribute captures the remote Host machine name from which the request somes in.
  • This attribute captures the IP address of the session in String format. (A.B.C.D)
Nested Schema : SessionData
Type: object
Session data present in the request.
Show Source
  • Flag to indicate if pattern analysis should be done for this session. Set this flag to true, if pattern based rules are used.
  • One of the config values from auth.status.enum. To check the possible values of the auth.status.enum, use the config property REST API operation GET with URL <PolicyURL>/policy/config/property/v1?propertyName=auth.status.enum. It is recommended to use a value corresponding to pending status when creating the session.
  • The client application of the user's session. This is a customer defined value, typically of the application name that is using or integrating with this API.
  • The client type of the user's session. One of the config values from client.type.enum. To check the possible values of the client.type.enum, use the config property REST API operation GET with URL <PolicyURL>/policy/config/property/v1?propertyName=client.type.enum
  • The version of the client application of the user's session. This is a customer defined value, typically of the version of the application that is using or integrating with this API.
  • External device id if the client wants to populate. This is a customer defined value, and can be used to identify, or indicate, a device name or some external Id, that this session may be coming from. A typical example can be a name or id of the terminal where the session is originating
  • Attribute is flag when true will result in registering the device for the user.
  • requestId for the request
Nested Schema : SessionUserData
Type: object
user related data
Show Source
Nested Schema : DeviceFingerprintData
Type: object
Device fingerprint data that is present in the request
Show Source
  • cookie type value from the enum configuration vcrypt.fingerprint.type.enum.
  • The finger print type of the user's session. Only 2 values are supported (browser (1) and javascript (4) ) values from fingerprint.type.enum. To check the possible values of the fingerprint.type.enum, use the config property REST API operation GET with URL <PolicyURL>/policy/config/property/v1?propertyName=fingerprint.type.enum
Request Body - application/json ()
Root Schema : schema
Type: object
Request object for creating the session
Show Source
Nested Schema : DeviceFingerprintDataList
Type: array
List of the device fingerprint data
Show Source
Nested Schema : IPData
Type: object
IP related data used during authentication
Show Source
  • The latitude of the location. Min value is -90 (negative values for sounthern hemisphere) and max value is +90 (positive values for northern hemisphere)
  • This attribute describes the accuracy of the location information (longitude, latitude pair). This attribute along with location accuracy units will indicate the accuracy. Typical example will be say within 2 meters of the indicated co-ordinates. For this example the value of this attribute will be 2.0 and the value of location accuracy type will be a enumeration pointing to metere.
  • Required when locationAccuracy is present. This attribute along with locationAccuracy attribute describes the accuracy of the location information (longitude, latitude pair). This attribute along with location accuracy units will indicate the accuracy. Typical example will be say within 2 meters of the indicated co-ordinates. For this example the value of this attribute will be a enumeration pointing to meter and value of locationAccuracy attribute will be 2.0.
  • Date time string in the format rfc3339 sec 5.6. https://tools.ietf.org/html/rfc3339#section-5.6 e.g format 2021-08-13T01:29:29.768Z
  • Required when locationAccuracy is present. This attribute indicates the type / method by which location was acquired. This is enumeration of the type location.source.type.enum. Some of the possible integer values will correspond to gps, asisted gps, wifi hotspot etc.
  • The longitude of the location. Min value is -180 (negative values for western hemisphere) and max value is +180 (positive values for eastern hemispehre).
  • This attribute is the proxy IP address of the session if proxy is present. (in A.B.C.D format)
  • This attribute captures the remote Host machine name from which the request somes in.
  • This attribute captures the IP address of the session in String format. (A.B.C.D)
Nested Schema : SessionData
Type: object
Session data present in the request.
Show Source
  • Flag to indicate if pattern analysis should be done for this session. Set this flag to true, if pattern based rules are used.
  • One of the config values from auth.status.enum. To check the possible values of the auth.status.enum, use the config property REST API operation GET with URL <PolicyURL>/policy/config/property/v1?propertyName=auth.status.enum. It is recommended to use a value corresponding to pending status when creating the session.
  • The client application of the user's session. This is a customer defined value, typically of the application name that is using or integrating with this API.
  • The client type of the user's session. One of the config values from client.type.enum. To check the possible values of the client.type.enum, use the config property REST API operation GET with URL <PolicyURL>/policy/config/property/v1?propertyName=client.type.enum
  • The version of the client application of the user's session. This is a customer defined value, typically of the version of the application that is using or integrating with this API.
  • External device id if the client wants to populate. This is a customer defined value, and can be used to identify, or indicate, a device name or some external Id, that this session may be coming from. A typical example can be a name or id of the terminal where the session is originating
  • Attribute is flag when true will result in registering the device for the user.
  • requestId for the request
Nested Schema : SessionUserData
Type: object
user related data
Show Source
Nested Schema : DeviceFingerprintData
Type: object
Device fingerprint data that is present in the request
Show Source
  • cookie type value from the enum configuration vcrypt.fingerprint.type.enum.
  • The finger print type of the user's session. Only 2 values are supported (browser (1) and javascript (4) ) values from fingerprint.type.enum. To check the possible values of the fingerprint.type.enum, use the config property REST API operation GET with URL <PolicyURL>/policy/config/property/v1?propertyName=fingerprint.type.enum
Back to Top

Response

Supported Media Types

201 Response

Creates session for the request.
Body ()
Root Schema : CreateSessionResponse
Type: object
session create response
Show Source
Nested Schema : CookieSet
Type: object
Show Source
Nested Schema : StatusResponse
Type: object
Status information for API call
Show Source
Nested Schema : SessionUserData
Type: object
user related data
Show Source

400 Response

Invalid input
Body ()
Root Schema : StatusResponse
Type: object
Status information for API call
Show Source
Nested Schema : SessionUserData
Type: object
user related data
Show Source

401 Response

Unauthorized

500 Response

Internal server error

503 Response

Service Unavailable
Back to Top

Examples

The following example shows a sample request and response for creating an OARM session for a user authentication request.

cURL Command to Create an OARM Session in JSON Format

curl --location --request POST '<RISK>/risk-analyzer/session/v1' \
--header 'Content-Type: application/json' \
--header 'Authorization: Basic <Base64Encoded(<username>:<password>)>' \
--data '{
    "user": {
        "loginName": "testuser",
        "groupName": "default",
        "userId": "testuser"
    },
    "ip": {
        "remoteIP": "10.175.171.219",
        "remoteHost": "TESTCLIENT",
        "proxyIP": "10.175.171.219"
    },
    "fpList": [
        {
            "cookie": "",
            "fingerprint": "accept-encoding#^#gzip, deflate, br#^#accept-language#^#en-GB,en;q=0.9#^#userAgent#^#Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko)Chrome/112.0.0.0 Safari/537.36",
            "cookieType": "1"
        },
        {
            "cookie": "",
            "fingerprint": "acn#^#Mozilla#^#ah#^#1040#^#an#^#Netscape#^#av#^#5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36#^#aw#^#1920#^#cd#^#24#^#ce#^#true#^#gl#^#51.4108518,-0.8705637,16.634#^#h#^#1080#^#je#^#false#^#l#^#en-GB#^#mt#^#application/pdf,text/pdf#^#o#^#true#^#p#^#Win32#^#pd#^#24#^#pl#^#PDF Viewer,Chrome PDF Viewer,Chromium PDF Viewer,Microsoft Edge PDF Viewer,WebKit built-in PDF#^#prod#^#Gecko#^#prods#^#20030107#^#tzo#^#0#^#ua#^#Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.6#^#w#^#1920",
            "cookieType": "4"
        }
    ],
    "sessionData": {
        "authenticationStatus": "999",
        "registerDevice": "false",
        "clientApplication": "OAA",
        "clientType": "0",
        "clientVersion": "12.2.1.4.0",
        "analyzePatterns": "true"
    }
}'

Sample Response in JSON Format

{
    "cookieSet": {
        "digitalCookie": "7f3cae97-1e16-4b98-937b-3aa89a0eb721",
        "secureCookie": "2435bb9e-9d91-46ec-a4df-9a168e149cb8",
        "requestId": "96eb744b-b84e-4c13-8b78-06b64ad81d94"
    },
    "statusResponse": {
        "responseCode": "0",
        "responseMessage": "",
        "status": true,
        "sessionId": "96eb744b-b84e-4c13-8b78-06b64ad81d94"
    }
}

cURL Command to Create an OARM Session in XML Format

curl --location --request POST '<RISK>/risk-analyzer/session/v1' \
--header 'Content-Type: application/xml' \
--header 'Accept: application/xml' \
--header 'Authorization: Basic <Base64Encoded(<username>:<password>)>' \
--data '
<?xml version="1.0" encoding="UTF-8" ?>
<CreateSessionRequest>
	<user>
		<loginName>testuser</loginName>
		<groupName>default</groupName>
		<userId>testuser</userId>
	</user>
	<ip>
		<remoteIP>10.175.171.219</remoteIP>
		<remoteHost>TESTCLIENT</remoteHost>
		<proxyIP>10.175.171.219</proxyIP>
	</ip>
	<fpList>
		<cookie></cookie>
		<fingerprint>accept-encoding#^#gzip, deflate, br#^#accept-language#^#en-GB,en;q=0.9#^#userAgent#^#Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko)Chrome/112.0.0.0 Safari/537.36</fingerprint>
		<cookieType>1</cookieType>
	</fpList>
	<fpList>
		<cookie></cookie>
		<fingerprint>acn#^#Mozilla#^#ah#^#1040#^#an#^#Netscape#^#av#^#5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36#^#aw#^#1920#^#cd#^#24#^#ce#^#true#^#gl#^#51.4108518,-0.8705637,16.634#^#h#^#1080#^#je#^#false#^#l#^#en-GB#^#mt#^#application/pdf,text/pdf#^#o#^#true#^#p#^#Win32#^#pd#^#24#^#pl#^#PDF Viewer,Chrome PDF Viewer,Chromium PDF Viewer,Microsoft Edge PDF Viewer,WebKit built-in PDF#^#prod#^#Gecko#^#prods#^#20030107#^#tzo#^#0#^#ua#^#Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.6#^#w#^#1920</fingerprint>
		<cookieType>4</cookieType>
	</fpList>
	<sessionData>
		<authenticationStatus>999</authenticationStatus>
		<registerDevice>false</registerDevice>
		<clientApplication>OAA</clientApplication>
		<clientType>0</clientType>
		<clientVersion>12.2.1.4.0</clientVersion>
		<analyzePatterns>true</analyzePatterns>
	</sessionData>
</CreateSessionRequest>
'

Sample Response in XML Format

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<CreateSessionResponse>
	<cookieSet>
		<digitalCookie>7f3cae97-1e16-4b98-937b-3aa89a0eb721</digitalCookie>
		<secureCookie>2435bb9e-9d91-46ec-a4df-9a168e149cb8</secureCookie>
		<requestId>96eb744b-b84e-4c13-8b78-06b64ad81d94</requestId>
	</cookieSet>
	<statusResponse>
		<responseCode>0</responseCode>
		<responseMessage></responseMessage>
		<status>true</status>
		<sessionId>96eb744b-b84e-4c13-8b78-06b64ad81d94</sessionId>
	</statusResponse>
</CreateSessionResponse>
Back to Top