First steps with the Boxis API

First steps

Call Boxis products from your application. The public address is https://api.boxis.net/. A project key signs each request. The secret is not sent.

Objective

The API lets you run account commands without the client area. SMS is live. A reserved section answers HTTP 501 and returns its canonical path. No command runs there until it is published.

Requirements

An active Boxis account.
Access to API keys in the client area. Creating, editing or revoking a key asks for the account password.
The API reference, for the command list and the language examples.

Create a key

Open API keys, Project tab, then Create new secret key. Choose All, Read only, or Restricted. You can set an expiration and a list of source IP addresses. An empty IP list allows every address. A filled list refuses the rest.

The reveal window shows three values once. The key id starts with bxk_. The account authorization starts with bxu_. The secret starts with bx_live_. Store them outside the source repository. The secret only signs requests.

A key listed under Legacy is an older SMS key. New applications use a project key.

First call

Start with getAPITimestamp. It does not send an SMS. The HTTP method of the call is POST. The signed route is GET /sms/timestamp. The same route must be granted on the key.

$secret = 'bx_live_...';
$consumer = 'bxu_...';
$body = '{"section":"/sms","command":"getAPITimestamp"}';
$timestamp = (string) time();
$canon = $consumer . "\nGET\nhttps://api.boxis.net/sms/timestamp\n" . $timestamp . "\n" . hash('sha256', $body);
$signature = hash_hmac('sha256', $canon, $secret);

Send that body to https://api.boxis.net/ with X-Boxis-Key, X-Boxis-Consumer, X-Boxis-Method, X-Boxis-Path, X-Boxis-Timestamp and X-Boxis-Signature. A success body contains result, message and data. A request older than 5 minutes, or sent twice, is refused.

Shell, PHP, Python and Node.js samples for each command are on the API reference. The signing rules are in How a request is signed.