Patent ID: 8621598

Claim:
A method for enabling a user to securely invoke a REST (Representational State Transfer) API (Application Programmer Interface) at an application server, the method comprising: establishing a first secure communication channel with an application server; sending, from a client, a first request to the application server to invoke the REST API, wherein the first request is sent using the first secure communication channel; receiving a security token from an authentication system in response to authenticating the user with the authentication system; receiving a nonce and a timestamp from the application server, wherein the nonce is a pseudo-random number that is generated by the application server and the timestamp is the application server's system time; determining, at the client, a security token digest by combining the security token, the nonce, and the timestamp; sending, from the client, a second request to the application server to invoke the REST API, wherein the second request includes the security token digest and the first request, and wherein the second request is sent using the first secure communication channel; receiving data at the client from the application server which is associated with the request to invoke the REST API; and storing the data.