Authentication with the 4Comply API

There are two types of endpoints in 4Comply: Protected Endpoints that need the private key to authenticate and Public Endpoints that do not.   Public Endpoints

  • POST /citizens/consent
  • POST /rightrequests   All other endpoints are Protected Endpoints.   To Authenticate with a Public Endpoint, you need to pass in your client_id in the header. Your Client ID is found under Settings in the 4Comply Dashboard:
"client_id": "my-client-id"

To Authenticate with a Private Endpoint, you need to pass in your secret key and the client id.   Your secret key must be kept private and should be regenerated if compromised. To regenerate your secret key, go to Settings in the 4Comply Dashboard.   To authenticate, pass the key as an Authorization header along with client_id:

"Authorization": "Bearer sk-asdhjaisd89yeiqsdahsdasd",
"tenant_id": "my-tenant-id"

Types of Users

4Comply Authentication uses RBAC roles for each user. To set permissions for a user, you can use the 4Comply Dashboard as an admin or call the POST /clientuser endpoint.   Only admin users or API calls with the account’s secret key can perform this action.   When a new user gets created in 4Comply, you must specify if they are an Admin or a Regular user.

  • Admin users have access to create new users in 4Comply. They can change the configuration, and they can see the secret key.
  • Regular users may only view lists and perform Right Request actions.

4Segments Users

Upon creation of a new 4Comply user, 4Comply will create a new instance of 4Segments. The instance parameters are:

  • Company Name: [4Comply instance name]
  • Username:[first name] “.” [last name] from 4Comply
  • Password: [randomly created]   The creator also receives an email with these parameters and a link to the 4Segments login screen.   After creating a new user, if they also need access to 4Segments, the admin should go to the 4Segments, and create the corresponding user there.