Environments & Authentication - Rep Data Documentation

Research Defender APIs are served from two domains. Each has its own environments and its own way of authenticating. All examples in this documentation use production; swap in the staging URL for integration testing.

rtymgt.com

Used by SEARCH, REVIEW, GETTOKEN, and the lookups.

Environment	Base URL
Production	`https://prod.rtymgt.com`
Staging	`https://staging.rtymgt.com`

Authentication

Keys are passed in the URL, as the final path segment of the request. Both are provided upon signup.

Key	Provided	Where it’s used
Publishable key	Upon signup	Client-side calls to SEARCH, REVIEW, and GETTOKEN.
Private key	Upon signup, for secured options	Server-side only: the Server-to-Server search call, signing URL Validation values, decrypting Encrypted responses, and the lookups.

Format:

https://<environment>.rtymgt.com/api/<version>/respondents/<endpoint>/<key>?<parameters>

Examples:

# Publishable key (client-side)
https://prod.rtymgt.com/api/v4/respondents/search/<publishable_key>?sn_ud=170716409&sy_nr=20210575&rt_cy_ce=us

# Private key (server-side)
https://prod.rtymgt.com/api/v3/respondents/destination_platforms/<private_key>

Keep your private key secret. Never expose it in client-side code.

resdefio.com

Used by ACTIVITY, ACTIVATION, GETTOKEN (new stack), and PREDUPE.

Environment	Base URL
Production	`https://prod.resdefio.com`
Staging	`https://stage.resdefio.com`

The standalone PREDUPE API runs on its own host: https://prod.search.resdefio.com for production and https://stage.search.resdefio.com for staging.

Authentication

Your authentication key is sent in the x-api-key request header. It is provided upon signup.

Header	Value
`x-api-key`	Your authentication key

Format:

x-api-key: <authentication_key>

Example:

curl -X POST "https://prod.resdefio.com/activity" \
  -H "Content-Type: application/json" \
  -H "x-api-key: <authentication_key>" \
  -d '{"Survey_Number": "<survey_number>", "Session_Id": "<session_id>"}'

Keep your authentication key secret. Call these APIs from your server where you can.

Client-Side Access to Cookies (SEARCH)

For Research Defender to access a respondent’s cookies on the browser side, the request must allow credentials. With a JavaScript-based implementation, set the withCredentials attribute to true:

var xhr = new XMLHttpRequest();
xhr.open("POST", url, true);
xhr.withCredentials = true;

This lets Research Defender better track duplicate and fraudulent respondents.

Protecting Against Suppression

To prevent respondents from manipulating links or suppressing the API response, use one of the secured SEARCH integrations: Server-to-Server, Encrypted, or URL Validation.

​rtymgt.com

​Authentication

​resdefio.com

​Authentication

​Client-Side Access to Cookies (SEARCH)

​Protecting Against Suppression

rtymgt.com

Authentication

resdefio.com

Authentication

Client-Side Access to Cookies (SEARCH)

Protecting Against Suppression