Beginning with version 9.0 Service Pack 1, Web API services use the standard OAuth 2.0 interface for credential authorization. All Advanced Inventory API requests, with the exception of PingUTC and ServerVersion, require a valid access_token for invocation. Authorization requests are made to an authentication service using the Resource Owner Password Credentials Grant, one of four grant types defined by the OAuth 2.0 standard. When either proper credentials or a refresh_token is provided, the authorization service returns an access_token/refresh_token pair. The access_token is then used for all subsequent Advanced Inventory API requests. If the access_token expires, the authentication uses the refresh_token to obtain a new access_token.

An access_token may also be revoked manually, which is similar to the previously supported Logoff request.  A revocation request made to the authentication service will invalidate the access_token and the refresh_token, thereby requiring the user to re-authenticate with their credentials the next time they require access to the Web API service.

Web API Service Agent maintains connectivity, processes message requests, and validates access by the clients to Mobile Enterprise Platform. To implement Web API services, you must configure Web API Service Agent and obtain the Client ID and Secret Key in Advanced Inventory Platform Manager.

Transport security is handled via standard SSL and non-SSL requests are rejected. Web API configuration allows for the disabling of SSL for testing purposes, but Advanced Inventory strongly recommends the SSL always be enabled in a production environment.