PS REST API Tokenization

Hi,

We've currently implemented a Web Service via REST where we are exposing several PS Core HR Functionalities through GET/POST method - consumers are mobile users and can post Submit Requests that is processed via Component Interface. What we are missing is the security part where this is currently set as none.

Here's what we are planning to do though, we do not have any supplementary knowledge to back this up.

1. External Systems triggers API Call

2. External Systems requests Token from Access Management Server

3. API Request is received by our systems, validates the token if valid

4.1 Valid token will invoke the API call