REST API

iCasework provides a range of powerful and extensible REST style web-services that allow both update and query operations such as case creation, case updates, adding case notes or retrieving case details to be invoked remotely. The APIs make integrating iCasework with other business critical systems simple and straightforward. ccc

The REST services are provided as HTTPS end-points that can be invoked with one or more parameters. Some services return an XML or JSON document whose contents vary depending on the operation performed.

Authentication

All APIs are authenticated using OAuth 2.0. Additional information on how to create JWTs can be found here.

Calling the API

After your application obtains an access token, you can use the token to make calls to the iCasework API. To do this, include the access token in a request to the API by including either an access_token query parameter or an Authorization: Bearer HTTP header. When possible, the HTTP header is preferable, because query strings tend to be visible in server logs.

When access tokens expire

Access tokens issued by iCasework expire one hour after they are issued. When an access token expires, the application should generate another JWT, sign it, and request another access token.

Access token format

If the JWT and access token request are properly formed and the service account has permission to perform the operation, then the JSON response from the Authorization Server includes an access token. 

Access restrictions

IP address

To enforce further security restrictions for REST web service calls, it is possible to limit the use of each allocated key pair to requests made from certain specified IP addresses. When allocating a new key pair, a list of allowed IP addresses can be set so that the given key and secret key can only be used to validate requests made from one of those IPs. Requests made from any other address using that key pair will be denied. Key pairs without IP restrictions will be accepted on requests made from any IP address.

User credentials

Additional security can be granted to API keys by associating them with a given user. The API will inherit that user's data visibility, filtering all data returned by any call to only what the associated user can access.

Responses to bad requests

When a bad request is made, the response will have a standard HTTP status code; also the response's header will include an X-Application-Error-Code and X-Application-Error-Info header that will provide more detail about the root cause of the issue.

Open

     Response headers in internet browser's developer tools

Open

Response headers in Postman

API List