API best practices

[AlgernonB]

We have a team that's going to be working on their own homegrown api project. I was in the process of setting them up and I had some reservations about generating them an API key for production right off the bat (wanted to start them off on preview or sandbox). Also I was wondering about code changes/updates when moving from their staging based code base to production (trying to minimize manual code updates for that team) Wondering if people are using Git or some other repo software to manage things. Just looking on tips to minimize work and to kick this off on the right foot. Thanks in advance community! -Al Algernon Browne WebMD

[MelindaLa1]

I strongly encourage the use of git or other source repositories, shared postman accounts to test individual API calls works well too. Best practice is to maintain both the domain name and session IDs as separate parameters in your environmental variables. Thus you can switch from mydomain.preview.workfront.com to mydomain.my.workfront.com with a single variable update instead of lots of hardcoding. In a similar manner the session keys can be updated periodically for security without breaking code. We also recommend that the API acts as a dedicated API user vs sharing a login with a named user of your system. This way API updates can be audited separately and reports don't break if the admin changes down the line. Melinda Layten Technical Project Manager - API and Integration Workfront