Authentication

The Investigation Service and the Integration Service are protected by OAuth 2.0. Two OAuth flows are supported, depending on the type of caller:

• Authorization Code flow – for interactive web applications used by human investigators / examiners.
• Client Credentials flow – for machine-to-machine integration (RMS, case-management systems, RPA).

The OAuth endpoints are exposed by the Authorization Service. The same access token is used for every subsequent request to the Investigation Service and the Integration Service.

Obtaining a token (Client Credentials)

The Client Credentials flow is the one most often used in system-to-system integrations. The integrating system authenticates itself with a client_id / client_secret pair and receives an access token.

POST /authorization/oauth2/token
Content-Type: application/x-www-form-urlencoded

grant_type=client_credentials
&client_id=<client_id>
&client_secret=<client_secret>
&scope=<requested scopes>

The response is a standard OAuth token response:

{
  "access_token": "<jwt>",
  "token_type": "Bearer",
  "expires_in": 3600,
  "scope": "..."
}

The token is a signed JWT that the API gateway validates locally (no token introspection round-trip is required at runtime).

Sending the token

Include the token as a Bearer token on every request to the Investigation Service or the Integration Service:

Authorization: Bearer <jwt>
X-User-ID: <user-id>
X-Transaction-ID: <uuid>
Innovatrics-Request-Id: <uuid>

Sample helper – C#

using System.Net;
using System.Net.Security;
using System.Security.Cryptography.X509Certificates;
using Innovatrics.Abis.Rest.Api;
using Innovatrics.Abis.Rest.Client;

static Configuration BuildAbisConfiguration(string accessToken)
{
    ServicePointManager.ServerCertificateValidationCallback +=
        (sender, certificate, chain, sslPolicyErrors) =>
            sslPolicyErrors == SslPolicyErrors.None ||
            certificate.Issuer.Equals("CN=<certificate issuer>");

    return new Configuration
    {
        BasePath = "https://<abis-middle-tier-url>",
        DefaultHeaders = new Dictionary<string, string>
        {
            ["X-User-ID"] = "<user-id>",
            ["X-Transaction-ID"] = Guid.NewGuid().ToString(),
            ["Innovatrics-Request-Id"] = Guid.NewGuid().ToString()
        },
        AccessToken = accessToken
    };
}

Sample helper – Java

import com.innovatrics.abis.rest.ApiClient;
import com.innovatrics.abis.rest.auth.OAuth;

private static ApiClient buildAbisClient(String accessToken) {
    ApiClient apiClient = new ApiClient();
    apiClient.setBasePath("https://<abis-middle-tier-url>");

    OAuth oauth2 = (OAuth) apiClient.getAuthentication("oauth2");
    oauth2.setAccessToken(accessToken);

    apiClient.addDefaultHeader("X-User-ID", "<user-id>");
    apiClient.addDefaultHeader("X-Transaction-ID", UUID.randomUUID().toString());
    apiClient.addDefaultHeader("Innovatrics-Request-Id", UUID.randomUUID().toString());

    return apiClient;
}

Permissions

Possession of a valid token is necessary but not sufficient to perform a request – the token must also carry the right scopes (or the user behind the token must have the right roles). The mapping between scopes / roles and operations is defined per deployment and enforced consistently across every endpoint.

The most common scopes for criminal investigation are:

Scope	Purpose
investigation.cases.read / investigation.cases.write	Cases CRUD.
investigation.evidences.read / investigation.evidences.write	Evidences CRUD.
investigation.examinations.read / investigation.examinations.write	Examinations CRUD and ACE-V transitions.
investigation.hits.read / investigation.hits.write	Hits creation / deletion.
civil.applicants.read / civil.applicants.write	Criminal records (applicants) CRUD.
civil.matching.identify / civil.matching.verify	Biometric identification / verification.

The exact scope catalogue is delivered as part of the deployment.