Privacy & Security
SPAR Privacy & Security
Last updated
SPAR Privacy & Security
Last updated
Copyright © OpenG2P. This work is licensed under Creative Common Attribution (CC-BY-4.0) International license unless otherwise noted.
SPAR APIs are consumed by two categories of clients
Beneficiaries logging on to the Self-Service-Portal (through the Self-Service-Client) and consuming the APIs provided by openg2p-self-service-api
Partner systems consuming the Mapper APIs provided by openg2p-spar-mapper-api. These partner systems can be Banks, National Clearing, PBMS/MIS Systems - systems in the G2P chain, using the lookup (resolve) API of Mapper. The openg2p-spar-self-service-api (of point 1) which serves the self-service-ui, in turn has to consume the mapper APIs. In this context, the openg2p-spar-self-service-api will behave like a partner system
Security of the payload during transmission (in both cases mentioned above) is handled using the https (SSL) implementation, using PKI.
This is handled by the Self Service API - integration with an OIDC - OAuth2.0 Login Provider. The beneficiary logs in, into the SPAR Self Service portal, using his/her National ID.
The Login Provider authorizes the beneficiary and provides the ID and Access tokens. The subsequent browser requests from the user, then carry these tokens to get access to the APIs.
There are two API paths, viz. auth and oauth, in the self-service-api, that fulfil these functionalities.
(the self-service application that consumes mapper-apis - In this case, the self-service application is treated like a partner system consuming mapper apis)
