RESTful Service for the 321Forms Onboarding Platform
Version 1.9.4
PRODUCTION
https://api.321forms.com/v1/
This service can detect the incoming resource extension in order to provide to you the resource represented according to the extension:
resource.json
| Service Extension Detection: | Yes |
|---|---|
| Allowed Extensions: | json |
| Throw On Invalid Extension: | Yes |
| Header | Type | Required | Default | Description |
|---|---|---|---|---|
| Authorization | string | true | NSA SHA-1 Encrypted Header (for information on how to create the Authorization Header, scroll to the Creating Acceptable Headers section of the document | |
| Username | string | true | Username of individual responsible for the call. | |
| SentDate | string | true | UTC Timestamp request of when header was created. The call will not be accepted if this timestamp is more than 10 minutes old | |
| Action | string | true | REST action type. |
The following are all the resources defined in the 321Forms RESTful Service API
Returns a list of companies that the user can access
List array of users in a company {:companyID} based on {:userType} Provided. Will only show users that the requesting account is allowed to manage
Returns a list of 100% onboarded users in the provided company {:companyID}. Sorted by latest approved form date (provided in response as 'utc_latest_approved_date')
Returns an array of the company's forms. This will be used when selecting the forms to provide for a new hire
Returns an array of form questions and an object with the basic details of the form itself
Returns a structure containing two elements. the companyID provided and an array of divisions
Returns an array of report objects
Returns a structure containing two elements. The first is an array of column headers and the second is the array of user responses with the keys equal to those headers
Returns an array of webhooks
Inserts a new webhook
Update an existing webhook
Returns information about an existing webhook
Deletes an existing webhook
Returns an array of available webhook 'topics'
Returns an array of the company's plugins.
Returns basic details for a given division.
Returns a list of users for a given division. Response format is the same as 'company/:companyID/:userType'
Returns a list of 100% onboarded users in the provided division {:divisionID}. Sorted by latest approved form date (provided in response as 'utc_latest_approved_date')
Returns an array of the division's flyers
Returns an array of the division's flyers
Returns an array of the company's forms, with the additional information on which forms are 'selected_as_default' for a division. This will be used when selecting the forms to provide for a new hire. An employee that is to be placed within a certain division should have the defaults selected if provided
Returns an array of questions that will be asked of an employee during account creation. These values are used for data that is variable for each employee, but needs to be entered prior to an employee signing their documents
Returns an individual username and active status based on known numeric user id.
Returns an individual user based on {:userID}.
Creates a new employee based on :userID
Updates an existing employee based on :userID
Tests if a username is available for use in a new account
Returns the lastest E-Verify case information about an employee
List the forms available to an employee and the UTC Timestamps of the latest submitted and approved versions
Receives response information to questions asked of a user
Receives basic user information for an employee's account
List the uploaded documents associated with the employee's account
Grabs an individual uploaded document
Returns a simple object with the variable 'SSOKey' that can be used to initiate a single sign-on account for a user
Returns an object that includes the endpoint to contiune with the SSO process. You must register your application as an SSO Provider with 321Forms prior to utilizing this endpoint
All RESTful service APIs should return appropriate HTTP Status Codes for every request.
| Code | Description |
|---|---|
| 200 | Success! |
| 201 | Created. A new resource has been created successfully. The response body is either empty or contains a representation revealing the URI of the newly created resource. |
| 202 | Accepted. The request was valid and accepted but not yet processed. The response body should containe a URI to poll for status updates or a token assigned to this request. This allows for asynchronous REST requests. |
| 204 | No content. The request was successfull but the server has no response for it. |
| 301 | Moved permanently |
| 302 | Moved temporarily. The requested resource resides temporarily under a different URI. Since the redirection might be altered on occasion, the client SHOULD continue to use the Request-URI for future requests |
| 400 | Bad request. Look at the accompanying error messages to see why the request was invalid. |
| 401 | Unauthorized. Client not authorized to make the request. |
| 403 | Forbidden. The request is understood, but it has been refused. Look at the accompanying error messages to see why the request was invalid. |
| 404 | Not Found |
| 405 | Method Not Allowed. The requested method is not allowed for that resource |
| 406 | Not Acceptable. Cannot generate representation with given formats, headers or parameters. |
| 410 | Gone, the resource is no longer available. |
| 429 | Too Many Requests. |
| 500 | Internal service error. |
| 503 | Service unavailable. Maybe too many requests. |
RESTful transactions are used because they are EASY!!, however we still need them to be secured. Because of that all requests made to our RESTful API must include the proper headers in order to proceed with a transaction
| Item | Description |
|---|---|
| 321Forms Username | The username attached to your 321Forms account |
| SSO Secret Key | AN SSO Secret Key can be generated by 321Forms by visiting the Edit Account page when logged into 321Forms. Only one secret can be generated at a time, so if you misplace your secret or believe it has been compromised, a new one can be generated in its place. NOTE: if you are a partner who already generates SSO keys for your users, the keys you generate can be used here as well. |
Once you have your SSO Secret Key, you are ready to start making calls to the web service. Each RESTful call requires four headers to be attached. For more information on the required headers, scroll to the API Global Headers section of this documentation. Of these headers, the Authorization header requires some work that will be detailed in the next section
The authorization header is built to ensure that malicious calls cannot be created by a third party on your behalf. The simple description is already listed in the API Global Headers section, however this section will step your through the encryption process
The json object contains three values that are exactly the same as your headers of the same name (Username, SentDate, Action). It is important to create this JSON exactly the same way it is represented on this page, as your requests will fail if the format varies.
sample_user:
{"Username":"sample_user","SentDate":"{ts '2014-10-20 19:32:48'}","Action":"GET"}
1234567890, your base64 representation of the hash will be C+ofkWM27JCzdkZKUndMEhOjA9o=. This result will be your Authorization header.
At this point, you have your 4 header values and the request should be able to be processed. Good Luck!