Action

OBJECT. Describes a single requested action that returns a result from the server. It is an element of the container element "Actions".

The specification of the attribute "ActionId" is mandatory for the correct identification of the action and clear assignment of the results.

actionid
MANDATORY. Identification of the action.

resourceid
MANDATORY. CAN BE EMPTY. ID of the record. If empty, a list of records is outputted, if defined for the action.

resourcetype
MANDATORY. CAN BE EMPTY. Type of record. Corresponds to a module in enterprise.

identifier
CAN BE EMPTY. Identifier for uniquely identifying the action. Useful if multiple actions are sent in a request.

parameters
MANDATORY. CAN BE EMPTY. Additional parameters of the action. Can contain any number of key-value pairs. The key-value pairs must be sorted alphabetically by key. The sort is non-recursively, e.g. only the first level of the array must be sorted. Possible parameters can be taken from the actions.

timestamp
Unix time. The current timestamp may be queried e.g. via the PHP function time().

hmac
The HMAC contains the hash of all parameters of the request. All values of the parameters array are sorted by key and encoded to JSON (in the example: $parametersBundled). Then the values of all request elements, which are sorted by alphabet, are listed comma separated without spaces ($fieldsBundled). These are then placed behind the JSON encoded parameters with a comma ($allParams).

The HMAC is then formed as follows: MD5(secret(MD5(parameter))).
Please make sure to work with lowercase hexadecimal representations of the MD5 value.

Sample code from the onOffice SDK:

function createHmac($id, $token, $secret, $timestamp, $identifier, $type,
$parameters, $actionId) {
	// in alphabetical order
	$fields['accesstoken'] = $token;
	$fields['actionid'] = $actionId;
	$fields['identifier'] = $identifier;
	$fields['resourceid'] = $id;
	$fields['secret'] = $secret;
	$fields['timestamp'] = $timestamp;
	$fields['type'] = $type;

	ksort($parameters);

	$parametersBundled = json_encode($parameters);
	$fieldsBundled = implode(',', $fields);
	$allParams = $parametersBundled.','.$fieldsBundled;
	$hmac = md5($secret.md5($allParams));
	return $hmac;
}