Authentication

Get started using the Tech Against Terrorism TCAP API. This document outlines how you can obtain an authentication token and use our API services. In order to use any of these strategies, you will already need to be an on-boarded TCAP or TCAP Archive user with a username and password.

Open API References:

• redoc
• swagger

Authentication Strategies

Short lived access token

To use some TCAP API services, you will need to obtain a resource-specific, short-lived access token.

Services which currently utilise this authentication system:

• Hash Verification API

Python

import requests

url = "https://beta.terrorismanalytics.org/token-auth/api/login"

payload = {
    "username": "YOUR_TCAP_USERNAME",
    "password": "YOUR_TCAP_PASSWORD",
    "requested_service": "Hash Verification"
}

headers = {
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)
print(response.json())

TypeScript

interface AuthPayload {
  username: string;
  password: string;
  requested_service: string;
}

const authRequest = async () => {
    const url = "https://beta.terrorismanalytics.org/token-auth/api/login";

    const payload: AuthPayload = {
        username: "YOUR_TCAP_USERNAME",
        password: "YOUR_TCAP_PASSWORD",
        requested_service: "Hash Verification"
    };

    const response = await fetch(url, {
        method: 'POST',
        headers: {
            'Content-Type': 'application/json'
        },
        body: JSON.stringify(payload)
    });

    const data = await response.json();
    console.log(data);

};
authRequest().catch(error => console.error(error));

cURL

curl -X POST \
https://beta.terrorismanalytics.org/token-auth/api/login \
-H 'Content-Type: application/json' \
-d '{
  "username": "YOUR_TCAP_USERNAME",
  "password": "YOUR_TCAP_PASSWORD",
  "requested_service": "Hash Verification"
}'

Response

200 OK
{
  "service_token": "JWT"
}

How long does the short lived token last?

At the moment, tokens are configured to be valid for 5 minutes. When a token expires, you will receive the following response with a status of 403:

Authentication error: Token has expired. Please refresh.

You can request a new token anytime and continue using it to make requests to your chosen service.

If engaging with the service programmatically, we recommend writing a script to request a new token whenever you receive a response with the status code as 403 and body "Authentication error: Token has expired. Please refresh."

Authenticating With JWT

Authentication for other services is more straightforward.

Services which currently utilise JWT authentication system:

• Content Hash List
• URL Hash List
• Submissions

Python

import requests

url = "https://beta.terrorismanalytics.org/token-auth/tcap/"

payload = {
    "username": "YOUR_TCAP_USERNAME",
    "password": "YOUR_TCAP_PASSWORD",
}

headers = {
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)
print(response.json())

TypeScript

interface AuthPayload {
  username: string;
  password: string;
}

const authRequest = async () => {
    const url = "https://beta.terrorismanalytics.org/token-auth/tcap/";

    const payload: AuthPayload = {
        username: "YOUR_TCAP_USERNAME",
        password: "YOUR_TCAP_PASSWORD",
        requested_service: "Hash Verification"
    };

    const response = await fetch(url, {
        method: 'POST',
        headers: {
            'Content-Type': 'application/json'
        },
        body: JSON.stringify(payload)
    });

    const data = await response.json();
    console.log(data);

};
authRequest().catch(error => console.error(error));

cURL

curl -X POST \
https://beta.terrorismanalytics.org/token-auth/tcap/ \
-H 'Content-Type: application/json' \
-d '{
  "username": "YOUR_TCAP_USERNAME",
  "password": "YOUR_TCAP_PASSWORD",
}'

Response

200 OK
{
    "token": "JWT",
    "user": {
        "id": 1,
        "username": "Jane",
        "first_name": "Jane",
        "last_name": "Doe",
        "email": "[email protected]",
        "organisation": "acmec",
        "permissions": [
          ...
        ],
        "job_title": "",
        "terms": "",
        "terms_archive": "",
        "email_verified": true
    }
}

Using the token

The token obtained from either strategy are used in the same way, you should attach it as a header to any API service request.

Python

import requests

headers = {
    "Authorization": f'Bearer {token}"
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)
print(response.json())

TypeScript

const makeRequest = async (url: string, payload: any, token: string) => {
  const response = await fetch(url, {
    method: 'POST',
    headers: {
      'Authorization': `Bearer ${token}`,
      'Content-Type': 'application/json'
    },
    body: JSON.stringify(payload)
  });

  const data = await response.json();
  console.log(data);
};

cURL

curl -X POST \
  https://beta.terrorismanalytics.org/your/api/endpoint \
  -H "Authorization: Bearer YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"your": "payload"}'

Further help

Our dev team would be happy to walk you through the authentication process.

If you wish to reach out in relation to this or anything else surrounding our API services, please contact us

Open API References:

• redoc
• swagger