Is HMAC signature value in API documentation correct

@Markus Vetsch

The host mentioned in the security document is an old host the latest host utilized it "api-worldcheck.refinitiv.com", but the underlying mechanism of hmac generation is correct and hmac value also depends on the date parameter, so a request sent now and a request sent next second will have a different hmac value.

As you can see below script from Postman that is used in a simple "Get my top-level groups API", here we have declared the values of attributes like host,url, API key etc in the Postman environment, but if you see the dataToSign value date is one of the attributes contributing to it which inturn goes into hmac.

However, I will follow up with the concerned team to have the host updated to reflect to the latest host in the documentation.

function generateAuthHeader(dataToSign) {
var hash = CryptoJS.HmacSHA256(dataToSign, environment["api-secret"]); return hash.toString(CryptoJS.enc.Base64);}
var date = new Date().toGMTString();
var dataToSign = "(request-target): get " + environment["gateway-url"] + "groups\n" + "host: " + environment["gateway-host"] + "\n" + "date: " + date;
var hmac = generateAuthHeader(dataToSign);
var authorisation = "Signature keyId=\"" + environment["api-key"] + "\",algorithm=\"hmac-sha256\",headers=\"(request-target) host date\",signature=\"" + hmac + "\"";
postman.setEnvironmentVariable("authorisation", authorisation);postman.setEnvironmentVariable("currentDate", date);

@Markus Vetsch

May I propose a quick meeting on Monday to go through this? Tomorrow is a public holiday here so let us know your availability for Monday we will happy to jump on a quick call and discuss this in length with you.

@Markus Vetsch

Sure, I have sent out an invite for Monday 8:30 AM GMT.

Speak to you on the meeting.

@Markus Vetsch

I have unaccepted the answer, we will continue our debugging over the email and update the solution and accept it here once we reach there.