Using LogicMonitor's REST API

LogicMonitor’s REST API currently supports HTTP Basic Authentication. To use HTTP Basic Authentication, each request must include an HTTP header with the following authentication information: “Authorization:Basic `echo -n username:password | base64`”

Almost all web clients support HTTP basic authentication and will construct this header for you.

The recommended authentication method for LogicMonitor’s REST API is our LMv1 API Token Authentication.  This authentication method requires that with every request you include a custom HTTP header containing your API Token Access Id, a base64 encoded HMAC signature based on your API Token Access Key, and a timestamp in epoch milliseconds.

Specifically, you will need to concatenate request details to form a string, and use your Access Key to calculate the HMAC-SHA256 of that string.  You will then need to base64 encode the result.  The complete base64 encoded HMAC signature should be in the following format:

And the full authentication header must be in the following format:

When LogicMonitor servers receive an API request, we first ensure the specified timestamp is within 30 minutes of the current time.  If that requirement is satisfied, we retrieve the Access Key associated with the specified Access Id and compute the signature in the above format.  We then compare that signature to the signature included in the request.  If the two signatures match, the request is authenticated, but still subject to the permissions associated with the API Token (the token Access Id and Access Key must have sufficient permission to perform the requested action).  In the event that the two signatures do not match, an error will be returned.

Note: Query parameters (e.g. filter, fields, sort, ,size, etc.) are not considered part of the resource path, and should not be included in the calculation of the LMv1 authentication signature.