Signature

In the case of the subscription, nullification and Mall API, an additional layer of security was added through of a signature that is sent in the request header, to obtain said signature is necessary the following:

The Request Path must be concatenated in url format along with all the request parameters, which must be ordered alphabetically by key, such that key = value. Therefore, if the client email value is "[email protected]" the correct format would be "example%40domain.com" and then concatenated with the character '&'.

Once the character sets are ordered and concatenated, the hash is calculated using the HMAC function with encryption type sha256, and the private token.

Note: If an element of the data has as value an object or array, it is excluded from the data. This function is in the PHP and Javascript example.

PHP Example

API Endpoint:

$request_path = urlencode('/api/suclient');

Sorting the parameters:

$data = [
  'email' => '[email protected]',
  'name' => 'Joe Doe',
  'phone' => '923122312',
  'address' => 'Moneda 101',
  'country' => 'Chile',
  'region' => 'Metropolitana',
  'city' => 'Santiago',
  'postal_code' => '850000',
  'additional_parameters' => [
    'parameter_1' => 'example',
    'parameter_2' => 'example 2',
  ]
];
ksort($data);

Transformation of the parameters to url format:

    $contador = 0;
    $concatenar = null;

    if (!empty($data) && !is_null($data)) {
        foreach ($data as $key => $val) {
            if(gettype($val)!='array' && gettype($val)!='object'){
                if ($contador>0) {
                    $concatenar .= '&';
                }
                $concatenar .= $key . '=' . urlencode($val);
                $contador++;
            }
        }
    };

Concatenation of the parameters in url format with the API endpoint:

$concat = $request_path.'&'.$concatenar;

Sign:

$sign = hash_hmac('sha256', $concat, 'fe551abcef62fcf002dc598922e68f0a');

JavaScript Example

Import CryptoJS dependency:

const CryptoJS = require("crypto-js");

API Endpoint:

const requestPath = encodeURIComponent('/api/suclient');

Sorting the parameters:

const data = {
  email: "[email protected]",
  name: "Joe Doe",
  phone: "923122312",
  address: "Moneda 101",
  country: "Chile",
  region: "Metropolitana",
  city: "Santiago",
  postal_code: "850000"
};
const orderedData = {};
Object.keys(data).sort().forEach(function(key) {
  orderedData[key] = data[key];
  if (typeof orderedData[key] === 'object') {
        delete orderedData[key];
  }
});

Transformation of the parameters to url format:

const arrayConcat = new URLSearchParams(orderedData).toString();

Concatenation of the parameters in url format with the API endpoint:

const concat = requestPath + "&" + arrayConcat;

Sign:

const sign = CryptoJS.HmacSHA256(concat, "fe551abcef62fcf002dc598922e68f0a").toString();

The result of the signature obtained for both examples is:

"d891663698d31aa8b68babe96ac6497f5a0d874024368102998d5b79a4d12c36"