Lua

HMRC Validate Fraud Prevention Headers

See more HTTP Misc Examples

Demonstrates how to test (validate) HMRC fraud prevention headers. Lua

local chilkat = require("chilkat")

-- This example requires the Chilkat API to have been previously unlocked.
-- See Global Unlock Sample for sample code.

local rest = chilkat.Rest.new()

local success = rest:connect("test-api.service.hmrc.gov.uk", 443, true, true)
if not success then
    print(rest.last_error_text)
    return
end

-- Load the previously fetched access token.
local json = chilkat.JsonObject.new()
success = json:load_file("qa_data/tokens/hmrc.json")
local accessToken = json:string_of("access_token")
print("Using access toke: " .. accessToken)

local sbAuthHeaderValue = chilkat.StringBuilder.new()
sbAuthHeaderValue:append("Bearer ")
sbAuthHeaderValue:append(accessToken)

rest:add_header("Accept", "application/vnd.hmrc.1.0+json")
rest:add_header("Authorization", sbAuthHeaderValue:get_as_string())

-- Add the fraud prevention headers.
-- See https://developer.service.hmrc.gov.uk/api-documentation/docs/fraud-prevention
rest:add_header("gov-client-connection-method", "DESKTOP_APP_DIRECT")

-- This should be generated by an application and persistently stored on the device. The identifier should not expire.
rest:add_header("gov-client-device-id", "beec798b-b366-47fa-b1f8-92cede14a1ce")

-- See https://developer.service.hmrc.gov.uk/api-documentation/docs/fraud-prevention
rest:add_header("gov-client-user-ids", "os=user123")

-- Your local IP addresses (comma separated), such as addresses beginning with "192.168." or "172.16."
rest:add_header("gov-client-local-ips", "172.16.16.23")
-- You'll need to find a way to get your MAC address.  Chilkat does not yet provide this ability...
rest:add_header("gov-client-mac-addresses", "7C%3AD3%3A0A%3A25%3ADA%3A1C")

rest:add_header("gov-client-timezone", "UTC+00:00")

-- You can probably just hard-code these so they're always the same with each request.
rest:add_header("gov-client-window-size", "width=1256&height=800")
rest:add_header("gov-client-screens", "width=1920&height=1080&scaling-factor=1&colour-depth=16")
rest:add_header("gov-client-user-agent", "Windows/Server%202012 (Dell%20Inc./OptiPlex%20980)")
rest:add_header("gov-vendor-version", "My%20Desktop%20Software=1.2.3.build4286")

local responseStr = rest:full_request_no_body("GET", "/test/fraud-prevention-headers/validate")
if not rest.last_method_success then
    print(rest.last_error_text)
    return
end

-- If the status code is 200, then the fraud prevention headers were validated.
-- The JSON response may include some warnings..
print("Response status code = " .. rest.response_status_code)
print("Response JSON body: ")
print(responseStr)