Re: REST web service APIs

On Fri, Mar 23, 2018 at 10:44 AM, Allen, Todd <Todd.Allen@xxxxxxxxxxxxxxxxx>
wrote:

To secure ReST service calls from a client you generally use something
like JWT or OAuth2.

You're talking about user authentication. That's just the first step.
Authentication gets you through the front door. It lets you talk to the web
service provider, but not necessarily to invoke APIs. For that, I was
suggesting that the service check the "authority" of the user to invoke
individual APIs. The web-service could look that up in a list (i.e. query a
table).

At any rate, do you see the difference between "authentication" and
"authority"?