MetaDefender Storage Security API v1

As mentioned earlier, all endpoints perform authentication and authorization checks. In order for these checks to succeed, a valid token should be presented in the Authorization header in the form of Bearer .

Suggested application logic

If you plan to integrate MetaDefender Storage Security in your custom application or workflow, please consider the following scenarios for successfully making REST API requests:

Short-lived integration

• Obtain a signed accessToken by calling /api/user/authenticate API

• Use this token to call your desired REST API by providing it in the Authorization header

• Expire the token by calling /api/user/logout

• Repeat steps 1-3 the next time your application needs to call a REST API

Long-lived integration

• Obtain a signed token by calling /api/user/authenticate API

• Securely save the received accessToken and the refreshToken

• Use the accessToken to call your desired REST API by providing it in the Authorization header

• Add an exception handler in case you receive a 401 Unauthorized response because the JWT has expired call /api/user/refreshToken to obtain a new accessToken by providing the saved refreshToken.

  a) the accessToken expires after an hour of creation; the expiry time is represented in UTC format by the accessTokenExpiryTime value.
  b) the refreshToken expires after an hour of creation; the expiry time is represented in UTC format by the refreshTokenExpiryTime value.
  c) if the refreshToken has expired as well, obtain a signed token by calling /api/user/authenticate API

• Use the newly issued accessToken to call your desired REST API by providing it in the Authorization header

API Key integration

• In the MetaDefender Storage Security interface, Navigate to Settings -> Users

• Find your user entry in the user list, click on the three dots on the right side of the entry, and then click on Generate an API Key

• Generate the key, copy it, and store it somewhere safe

• Use the API Key to call your desired REST API by providing it as a header with the Key: "ApiKey" and Value:

General considerations

The access token expiration date cannot be extended. By default, the access token is valid for an hour after calling /api/user/authenticate API to obtain it.The refresh token is also valid for an hour but can be extended by calling /api/user/refreshToken and it is also automatically extended with an hour with each non-GET request.

A refresh token is used to request a new access token when the current one expires without requiring re-authentication using a username and password.

The refresh token is used to forcibly expire any previously issued JWT when the refresh token expires or is removed by calling /api/user/logout.

A 3rd party application that needs persistent connectivity with MetaDefender for Secure Storage should implement a timeout mechanism to ensure that the refresh token is renewed before it expires by calling /api/user/refreshToken whenever the JWT (access token) is expired but before the refresh token expires as well.