New Xton Documentation Center
Xton help has moved. Please visit the current version of this page for the most recent updates. Our new documentation center can be found at help.xtontech.com.
How to use the XTAM REST API when Cross-Site Scripting protection is enabled
This error (API token verification error) means that from the authentication perspective everything is fine. For example, you can get any information from XTAM at this point. However, to use POST and PUT to create or change something, there is another level of protection from cross-site scripting attacks which is completely unrelated to authentication tokens. The carrier of this protection is also called token (API Token this time or XSRF Token) but it has nothing to do with authentication token that are referenced here.
To get this token you need to call /rest/user/whoami function – it is a GET function so you do not need API Token to call it (you still need Authentication Token and Auth Cookie). It is the only function that generates API token and returns it in the XSRF-TOKEN cookie (Set-Cookie response header).
Below is the link with the example of how to get this XSRF-TOKEN:
https://www.xtontech.com/resources/faq/rest-api-shell-scripts/#apitoken
You need to pass a value of this XSRF-TOKEN as a X-XSRF-TOKEN header when POST or PUT anything
Below is the link with the example how to send this API Token as a header (scroll to create record section). Note that this example does not include the part to retrieve the API Token that was mentioned above (because you need to get it for every function or get it in the beginning for all functions so we removed it to the bottom of the page as a separate example to make the API examples cleaner).
https://www.xtontech.com/resources/faq/rest-api-shell-scripts/
XSRF-TOKENS are relatively short lived so there is no point to save them – call whoami every time in the script. The XTAM GUI itself calls this function in the beginning so you can login to XTAM, open dev console, network tab, refresh the page and find the call to whoami to see what does it return. Something like update a record will use this token as a header which is also visible on the browser’s dev console.