OBJECT. Describes a single requested action that returns a result from the server. It is an element of the container element "Actions".

The specification of the attribute "ActionId" is mandatory for the correct identification of the action and clear assignment of the results.

MANDATORY. Identification of the action.

MANDATORY. CAN BE EMPTY. ID of the record. If empty, a list of records is outputted, if defined for the action.

MANDATORY. CAN BE EMPTY. Type of record. Corresponds to a module in enterprise.

CAN BE EMPTY. Identifier for uniquely identifying the action. Useful if multiple actions are sent in a request.

MANDATORY. CAN BE EMPTY. Additional parameters of the action. Can contain any number of key-value pairs. The key-value pairs must be sorted alphabetically by key. The sort is non-recursively, e.g. only the first level of the array must be sorted. Possible parameters can be taken from the actions.

Unix time. The current timestamp may be queried e.g. via the PHP function time().

The HMAC contains the hash of all parameters of the request. All values of the parameters array are sorted by key and encoded to JSON (in the example: $parametersBundled). Then the values of all request elements, which are sorted by alphabet, are listed comma separated without spaces ($fieldsBundled). These are then placed behind the JSON encoded parameters with a comma ($allParams).

The HMAC is then formed as follows: MD5(secret(MD5(parameter))).
Please make sure to work with lowercase hexadecimal representations of the MD5 value.

Sample code from the onOffice SDK:

function createHmac($id, $token, $secret, $timestamp, $identifier, $type,
$parameters, $actionId) {
	// in alphabetical order
	$fields['accesstoken'] = $token;
	$fields['actionid'] = $actionId;
	$fields['identifier'] = $identifier;
	$fields['resourceid'] = $id;
	$fields['secret'] = $secret;
	$fields['timestamp'] = $timestamp;
	$fields['type'] = $type;


	$parametersBundled = json_encode($parameters);
	$fieldsBundled = implode(',', $fields);
	$allParams = $parametersBundled.','.$fieldsBundled;
	$hmac = md5($secret.md5($allParams));
	return $hmac;

If you get a “HMAC invalid” error: Floating point values should be encapsulated in a string, e.g. “breitengrad”:”52.65434″ to avoid rare rounding errors. The API regarding the HMAC calculation expects that in JSON strings the character ‘/’ is always encoded as escape sequence ‘\/’