> The current Elgg REST API is not really RESTful but more of a REST/RPC
> hybrid approach (similar to Twitter, Facebook, Flickr). It is not
> structured well to handle more than GET/POST in a nontrivial fashion.
> As such, I think I'm going to stick with the current GET/POST
> restrictions. Any comments?

> On Oct 23, 8:30 am, Cash Costello <cash.coste...@gmail.com> wrote:

> > I've used php and java with the current hmac without any problems (and
> > I did not write it). I'm going to look into making it compatible with
> > OAuth:http://oauth.net/core/1.0#anchor16

> > I've add a simple api auth method that just requires the public key.
> > This is probably sufficient for using the API to integrate
> > applications and for a lot of external facing uses, too.

> > I noticed from your client that you are using more than GET and POST.
> > That's also something that I've kicked around but wasn't sure anyone
> > would use it.

> > On Oct 23, 7:15 am, milan <mi...@magudia.com> wrote:

> > > 1) Yes - I think we are, but not open sourced api's

> > > 2) Created elgg based web services

> > > 3) See 4!

> > > 4) We're using the HMAC signatures or to be accurate we tried to use
> > > them and found them to not be compatible with other tool sets and
> > > languages. The problem I think was that the HMAC was calculated into
> > > hex values and not encoded into a standard canonicalized format which
> > > doesn't change across toolkits.

> > > a) The actually format of the string to sign wasn't normalised to
> > > UTF-8 (not normally an issue, but can be)
> > > b) The hmac isn't generated using binary values (see:http://php.net/manual/en/function.hash-hmac.php)
> > > c) If the hmac is in binary then the output of this can be base64
> > > encoded into a standard strict format, which is built into nearly
> > > every language by default (apart from *cough* java where you need a
> > > external jar).

> > > Why do this? As other languages by default out put binary values from
> > > the HMAC and also the hex output is generally unpredictably different.

> > > I have an example client here:http://www.hedgehogs.net/mod/studios/client/php/

> > > We also did away with doing different Hashes for POST and GET.
> > > Basically we had a look at the Amz S3 model and then overloaded the
> > > current API - I think.

> > > As for 5) and 6), i'll ask Sammy as he done more API work than I have!

> > > Milan

> > > On Oct 22, 2:40 pm, Cash Costello <cash.coste...@gmail.com> wrote:

> > > > Hi, Antoine

> > > > If you're just starting out, I recommend grabbing the latest REST api
> > > > from svn because it has a lot of bug fixes. The files you need are:

> > > > /engine/lib/api.php
> > > > /engine/lib/pam.php
> > > > /engine/lib/xml.php
> > > > /languages/en.php (error messages)
> > > > /services/api/rest.php

> > > > Note that api.php has a hook into Elgg's new unit testing framework
> > > > but you won't be able to use that without grabbing more files from
> > > > svn. Also, currently the schema in SVN has a bug which breaks the
> > > > activity river.

> > > > Cash

> > > > On Oct 22, 5:49 am, Ant- <antoine.raba...@gmail.com> wrote:

> > > > > Hi Cash and everybody.
> > > > > to answer your survey:

> > > > > 1) No but it's a project

> > > > > 2) iPhone and adroid application

> > > > > 3) not yet but I will implement it

> > > > > 4) just setting that up right now :)