General information

Communication between service modules (e.g. Tax Data Hub, Tax Transfer Hub) and business modules (e.g. Tax Balance, Income Taxes) within the GTC Suite must be secured. Since the service modules do not manage authorisation contexts, this must be regulated by the respective business module. To ensure that only known business modules can call the endpoints of the service modules, the service module provides an API key that the business modules must send with requests. 

Creating the API key in the service module

The user can create the API key in two ways, whereby automatic generation is preferred. Nevertheless, for IT security reasons, the API key should be renewed regularly.

Automatic generation of an API key

If the server starts up and no API key has been created yet, the API key is automatically generated in the form of a 32-digit alphanumeric string. This can then be taken from the log.

The generation takes place once and is also only written once in the log. The API key should be temporarily noted and the log should be deleted.

Manual generation of an API key

The API key is given as a Tomcat start parameter.

The key must be 32 digits long and contain alphanumeric values, otherwise it will not be recognised as valid and will not be permitted. If the validation of the key fails, this is displayed in the log.
It should be ensured that the key was generated randomly.

The Tomcat start parameter is called