Privacy & Security
SPAR Privacy & Security
SPAR APIs are consumed by two categories of clients
Beneficiaries logging on to the Self-Service-Portal (through the Self-Service-Client) and consuming the APIs provided by openg2p-self-service-api
Partner systems consuming the Mapper APIs provided by openg2p-spar-mapper-api. These partner systems can be Banks, National Clearing, PBMS/MIS Systems - systems in the G2P chain, using the lookup (resolve) API of Mapper. The openg2p-spar-self-service-api (of point 1) which serves the self-service-ui, in turn has to consume the mapper APIs. In this context, the openg2p-spar-self-service-api will behave like a partner system
Transport Security using a Secure Tunnel
Security of the payload during transmission (in both cases mentioned above) is handled using the https (SSL) implementation, using PKI.
Authentication
Case 1 - Authentication of Beneficiaries (Browser Client Application) consuming self-service-apis
Case 2 - Authentication of Partner Systems consuming mapper-apis
(the self-service application that consumes mapper-apis - In this case, the self-service application is treated like a partner system consuming mapper apis)
Partner Authorization
Onboarding a Partner to consume an OpenG2P API
API Call by Partner
JWT Schematic
Validation of JWT using MOSIP Key Manager
Last updated
