Securing the Pega API

To ensure the safety of Pega API credentials that are transferred through HTTP basic authentication, use TLS 1.2, a strong transport layer security, when installing your Pega application.

  1. Deploy your Pega application by creating and installing TLS/SSL digital certificates on your web application server for the Pega application. For instructions, see the documentation for your server.
  2. Confirm that the Pega API is configured to use TLS/SSL, which is enabled by default. On the Edit Service Package dialog box for the API service package, ensure that Requires authentication, Use TLS/SSL (REST only), and Suppress Show-HTML are selected.
  3. Test the Pega API in Designer Studio and ensure that the URL starts with https://, the connection uses TLS 1.2, and users are prompted for their Pega credentials the first time the Pega API is used in a browser session.

Following are some guidelines for roles and privileges that you might need to configure.

  • PegaRULES:PegaAPI role - When you create an application, explicitly add the PegaRULES:PegaAPI role to a user's access group so that the user can use the Pega API.
  • PegaRULES:PegaAPISysAdmin role - Explicitly add the PegaRULES:PegaAPISysAdmin role to a user's access group to provide access to the Pega API REST user services as a system administrator. This role is not required for other services.
  • pzSystemOperationsObserver and pzSystemOperationsAdministrator privileges - To use the Caches, Pools, and Nodes APIs, you must have the following privileges:
    • To perform GET operations, the pzSystemOperationsObserver  privilege.
    • To perform other operations, for example, PUT, DELETE, POST, the pzSystemOperationsAdministrator  privilege.