API questionnaires

Cross Identity APIs are incorporated with HTTPS, and all requests are encoded. Clients must also use CI’s encryption utility to encrypt user details, such as passwords, before sending the request via the API. It means Cross Identity provides multiple layers of security when transmitting data between CI and the client application.

No, Cross Identity APIs are primarily used for centralized authentication and do not provide session management. The target application needs to handle this based on the response received from CI. For example, if the client gets a "Success" response, the target application must create a session for the user. If the response is "Fail," the client should return an error message.

Cross Identity does not create a session ID; it is generated by the client. The client must have standardized methods to prevent session duplication. They can use dynamic session ID creation, ensure the system generates unique session IDs for each session, or allow only one active session per user at a time.

Cross Identity provides out-of-the-box SSO features supporting federated protocols such as SAML and OAuth/OIDC. To enable standardized SSO, the client application must support federated protocols so that SSO can be established between Cross Identity and the client application.

Yes, Cross Identity supports MFA APIs. Client applications can invoke these APIs to validate two-factor authentication (2FA). Cross Identity provides the following MFA factors:

• Email OTP

• SMS OTP

• Security Questions

• TOTP

• Passwordless

Yes, integrating Cross Identity APIs requires certain changes. The AuthReqAPI is mainly used to authenticate users with login details such as username and password. When requesting, the client application must send these details in an encoded format, and the CI encryption utility must be used to encode the data before sending it to Cross Identity.