In scope of GTO Product offering, an anti-corruption layer was built to provide an uniform communication model to multiple Business Units, allowing consumer Systems (Global Applications) to be agnostic to the data source.

As part of the self-service models and in order to ensure access to profile details this API is exposed, providing the required profile information.

How this can help you

Allow access to local business unit profile information, allowing access to profile information in an uniform way independent of the location, if a certain Business Unit data is required, a pre-enablement with GTO Global Solutions will be required.

How does it work

The Profile Process API based on context information (Business Unit) will route the request to the relevant system on the Business Unit and return a common data model with profile details.

How do I get access

New applications wishing to use the service can request access via the API Exchange. As part of the request, you will be asked for a cost center and to select the service tier you require. Once the API Owner accepts your request you will be issued a Client ID and Secret which you can use to call the API. See Getting Start page for more information.

All our API’s are designed to be easy and fast to consume! You can play with them from day 0 through our built in mocking services (were you can explore our API's before any further engagement), but if you want the real deal go through our Terms and conditions and Pricing pages and get started without exiting this site.

Step 0. First time

If this is your first time using one of our API's we suggest to go through our SharePoint site page were you can find a lot of information, of the basic concepts used through this API page.

Step 1. Request API access

Yes, just click on the "Request Access" button in this page where you will need to:

1. Select the Environment you want to access (more details on our Environment page)
2. Select the right tier for your application, you can find more information on Pricing page and move to the next screen
3. "Select an existing client application" or "Create a new application" that will be allowed to call this api
4. Read the Terms & Conditions and check the box to accept them
   • Terms and conditions vary between API's, it is important take knowledge of this information to prevent any API misusage
   • Please read Terms and conditions page to know our global terms and this API specific terms
5. Access approval & account setup
   • All access requests are assessed and approved within 1 working day, during this phase you might be contacted for specific details (e.g. cost centre)

Step 2. Use the API

Once you client application gets approved, and you have your credentials, you can visit our Authentication page to understand which authentication mechanism should be used to interacting with our API.

You can use this API through your preferable wrapper, MuleSoft, Azure API, Java, Python... Just follow our API Run Flow to understand how to use it, or explore our API documentation to see in more detail our API documentation.

Step 3. Monitor your API

Monitorization of your API is also a key aspect to improve you API usage, our API's are actively monitored, please through our Support page to know more on our monitoring solution.

Step 4. Maintain your Application

We are always looking to improve our API's, this means that is also important for you to know how this API can evolve and how we manage it.

The Versioning page details which versioning model is being used, and how this can affect your dependent applications.

Step 5. Provide feedback and get support

Visit your Support page to know how to interact with us, but while you are here, feel free to use our Reviews section

Step 6. Decommissioning

Hope you are not thinking about it :) But if you must, simply delete your Application on "My Applications" page, and you will be unregistered from this API.

How am I charged?

To be DEFINED

When am I charged?

Charges will start 30 days after you commence using the API and you can cancel anytime during this period. Thereafter billing will occur monthly to the cost centre that you specify.

In order to speed up your integration we prepared a curated Zurich Postman collection which you can found on Zurich Postman Enterprise - CC_API_Centre for Enablement.

If you are a Zurich employee / contractor and you don't have access, please visit Zurich Get Postman link, and take the oportunity to visit our C4E Postman Best Practices while your access is being aproved.

Configure your environment variables

As defined on the Postman Best practices, this is a shared Collection, which is already curated for initial use.

When using the provided collection, please ensure you create your own copy into your team workspace and don't update the collection.

Only current values in environment properties can be changed as presented below:

Run your postman collection

Once you have configured the environment variables feel free to invoke the available methods and retrieve the API details.

Any additional question please contact the C4E team

Our API is protected by Basic Auth: standard HTTP Authorization header with the authorization type to Basic

The user and password are governed through an Anypoint Platform enforced Client Id/Secret policy.

Client ID/Secret

Complete the pre-requisite steps on the Getting Started page to obtain API client credentials.

The Client Id/Secret is enforced using the Basic Authentication scheme. This requires the client_id and client_secret values are communicated using the standard HTTP Authorization header with the authorization type to Basic.

The format of the Authorization header is as follows:

Basic client_id:client_secret

In accordance with the Basic Authentication specification the client_id:client_secret value must be passed as base64-encoded string as shown below:

Basic Y2xpZW50X2lkOmNsaWVudF9zZWNyZXQ=

The API will return a 401 HTTP Status Code with code authentication_error in case of an invalid value or credential.

This API uses conventional HTTP response codes to indicate the success or failure of an API request:

• Codes in the 2xx range indicate success.
• Codes in the 4xx range indicate an error that failed given the information provided (e.g., a required field was omitted).
• Codes in the 5xx range indicate an error with the server.

The sections below explain in detail the HTTPS status codes returned by the API and the error response message returned to the user.

Error HTTP Status Code Summary

The table below contains all the possible HTTP status codes that the API returns, however, one should refer to each individual resource and method endpoint definition for specific details on the possible status codes returned.

Please refer to each individual resource and method endpoint definition for specific details on the possible status codes returned.

Error Response

Independently of the error scenario a common error structure will be returned, allowing consumers to manage error results through a common structure, below the specific attributes that compose this error message structure can be checked in more details.

Attributes

Error Response Payload Examples

{
  "code" : "RESOURCE_UPDATE_FAILED",
  "message" : "Cannot update User account groups",
  "correlationId": "3d9445ca-dd6c-4fe2-b93d-c23423f0d612",
  "causes": [
    {
      "code": FAILED_UPDATE_SECURITY_TYPE_DEFAULT,
      "message": "Failed to set security type to 1"
    }
  ]
}

Exchange Name: gto-p-profiles

Environments available.

This API is provided as Process API with the view that consumers will integrate it either directly into their application or within local experience APIs.

By default we only publish the Mock and Production versions of the API for consumption because the underlying service is the same in all circumstances. Additional environments can be subscribed on special request.

URLs

This API is published to the following environments but may be made available in the following environments:

Please refer to the API instances section to view which deployments are available.

Additional environments are provided for development of the API but these should only be used in consultation with the API team.
By default all stateless systems that don't require specific environment data (e.g.: email, SMS) are only available in Production.

The C4E is committed to continuously improving and expanding the developer experience provided to consumers of this template for Mule API/integration applications. The lifecycle of this template asset is managed using Semantic Versioning.

Where possible, the C4E team will make changes to the API but not change the version number because the changes are not considered to be backward compatible. Such changes can be any of the following:

• Addition of new resources
• Addition of new non-mandatory request parameters of attributes
• Addition of new data fields returned in the response
• Change in the order of data fields returned by the API

There might be some instances in which breaking enhancements need to happen. In such circumstances, a new version is released not to break compatibility. Such enhancements include:

• Inclusion or removal of mandatory parameters
• Restructuring of the API interface

Upon the release of a new version, applications can continue using the old version, allowing the consumer to assess the changes needed. Release notes with all the changes will be provided with every new version, describing all the changes in detail.

Upon upgrading, consumers are required to request access to the new major version of the API. Given the potential breaking changes, consumers are encouraged to perform regression testing against the new version before upgrading to the new API version in production.

Please refer to the API instances section to view which minor version is currently in use per environment and Decommissioning Process for more details on the version upgrade process.

Contact the C4E team or your local service desk for more information or support.

If you are already having a specific issue, maybe our Known Issues section may help you:

Known Issues

Nothing to report... Hooray!

API Minor / Patch / Implementation upgrade

As out Organization evolves, so do our API to keep supporting richer functionalities and keep up with business requirements, leading to API Specification changes that does not impact consumers.

As those changes are made available a specific process will be followed to allow consumers to be aware of the new functionalities but check if no side impact occurs on the consumer side, the process defined is:

Note: Hot-fixes are by nature an exception process, and will not follow the defined process (e.g.: emergency releases as experience during Log4J2 vulnerabilities). For those scenarios, a specific process will be followed.

API Major release / Decommissioning

A minor/patch upgrade version approach will be the preferable approach, although, in some scenarios that approach cannot be followed due to external factors as for example:

• Breaking changes on end systems due to system upgrade
• Change of API system provider leading to major data changes not compatible with current version
• New functionalities that forces additional data to be provided

As running parallel API versions requires additional Infrastructure and Support activities, older major releases will be decommissioned as per Terms of Service SLA, below is presented the high level process and flow in use to manage the overall decommissioning activities:

Note: For scenarios that due to external factors API co-existence cannot be met, an exception process will be shared with all API consumers to present the exception process and impact, in order to minize API Consumers impact.

For additional information please Contact the API Owner.

v1.0.0: Unreleased

Description: First release of the Profile Process API

Features:

• Implementation of the following base paths:
  • GET /profile/{profileId}: allow access to profile details.
  • PATCH /profile/{profileId}: to update profile details.

Known service limitations:

No limitation to report