API Documentation

• Documentation about the Snow License Manager (SLM) API is accessible through the Snow Docs portal.

Configuring the API to use SSL/TLS and be hosted over HTTPS

• The Snow License Manager web application should use SSL/TLS and be hosted over HTTPS.
• The following article from Microsoft describes how to secure an IIS web site with SSL: https://learn.microsoft.com/en-us/iis/manage/configuring-security/how-to-set-up-ssl-on-iis
• PLEASE NOTE: 
  • The API is not an OData service per se. The API supports a limited subset of the OData protocol, namely the query string options $orderby, $top, $skip, $filter, and $format.
  • The API uses a custom implementation of basic authentication. In order for this to work, basic authentication in Microsoft Internet Information Services (IIS) needs to be disabled.

Snow License Manager API

• The API uses basic authentication to authenticate requests. This mechanism provides no confidentiality protection for the transmitted credentials out of the box. Username and password are encoded with Base64 but not encrypted in any way.
• Transmitting credentials in Base64 is effectively no more secure than sending them as clear text, so if the API is hosted in such a way that eavesdropping on the communication between the client and the server is possible, there will be a significant security risk.