Transcript restful-apis-in-powershell-vfinal

RESTful APIs in PowerShell
Who am I?
• Worked in Windows for 11 years
• Worked with PowerShell for 4 years
• I work as Windows Automation
Engineer at Rackspace
• I build internal tools that make the jobs
of the front line support techs easier
Martin Howlett
@WillCode4Pizza
What we will cover
• Introduction to APIs
• Invoke-RestMethod v. Invoke-WebRequest
• Authentication
• JSON
• Examples
• Chaining examples together
• Security
Introduction
What is a restful API?
• A structured web service that allows you retrieve data or perform
actions easily
Powershell
(Invoke-RestMethod)
https://www.quora.com/What-is-a-REST-API
Web
service
Database
API’s everywhere!
• Weather
• Bing web search
• StackOverflow
• CurrencyLayer
• Calendar
• Google Maps
• PayPal
• Comic Vine
• Spell check
• URL shortener
• Spotify
• Minecraft
• Train times
• Meetup
• Soundcloud
• Pokéapi
• Confluence
• eBay
• IBM Watson
• Postcodes.io
• Twitter
• Dropbox
• Wolfram Alpha
• Nutritionix
• Youtube
• Buses
• New Relic
• An API of Ice And Fire
• Jira
• Amazon
• LinkedIn
• Netflix Roulette
• Slack
• Rackspace
• File.io
• TFL
• WordPress
• Facebook
• Yelp
• Wordnik
• Instagram
• Reddit
• RoboHash
• UK Police
• BreweryDB
• RandomUser
• Wikipedia
• Flikr
https://github.com/toddmotto/public-apis | http://www.programmableweb.com/apis/directory
API verbs
Verb
Action
Get
Retrieve data
Post
New data / action
Example
Invoke-RestMethod -Uri $uri -Method “Get”
Invoke-RestMethod –Uri $url –Method “Post” -Body $Json
Delete
Remove data
Invoke-RestMethod –Uri $url –Method “Delete”
Put
Update data
Invoke-RestMethod –Uri $url –Method “Put” -Body $Json
The Invokers
Invoke-WebRequest
• Expects HTML as a response
• Returns headers
• Good for querying normal web pages
Invoke-RestMethod
• Expects JSON or XML as a response
• Only returns data by default (no headers etc)
• Good for querying RESTful APIs
Authentication
Authentication
• Authentication allows:
• Authorization
• Tracking
• Throttling
• Authentication is done via an API key or token
• You get tokens normally after signing up from the website
portal
• Tokens are typically a 32 character alpha numeric string
Authentication - Headers
• Headers are created in hash tables
• Most common headers are “X-Auth-Header” or “Authentication”
• Examples APIs:
• JIRA, Confluence, Rackspace Cloud, Twitter and Mailgun
Authentication - URL parameters
• Simply chuck the token in as an URL parameter
• Common in “simpler” APIs
• Examples APIs:
• Google URL shortener, Wolfram Alpha and OpenWeatherMap
JSON
JSON
• JSON is a “human readable” language
independent data format
• Complex APIs will use JSON to send data
• Most APIs will return JSON
• Powershell 3+ natively to convert data to
and from JSON
ConvertTo / ConvertFrom examples
ConverTo-Json will fix your mistakes
The 2 problems with ConvertTo-Json
• Use –depth to make sure you convert your JSON “all the way down”
The 2 problems with ConvertTo-Json
• It will automatically convert special JSON characters <>\'&
Examples!
Weather
https://github.com/willcodeforpizza/PoshWeather
Google URL Shortener
https://gist.github.com/willcodeforpizza/56f776c31b56f5c322031e0d37c1a5fa#file-googleurlshortener-psm1
Spell Check
• Uses the Microsoft cognitive API suite.
• Same API Office online uses!
https://github.com/willcodeforpizza/PoshMicrosoftCognitiveApi
Ask Scripting Guy
• Uses the Microsoft cognitive API suite - Bing search filtered to the Scripting Guy site
• Automatically open first hit in Firefox
https://github.com/willcodeforpizza/PoshMicrosoftCognitiveApi
Mailgun
• Removes dependency on a SMTP server
• Useful for alerting or reports
https://github.com/willcodeforpizza/PoshMailgun
Slack
• Real time alerting for more critical alerts
• Even do real time script usage
https://github.com/willcodeforpizza/PoshSlack
New Relic
• Script tracking and usage
• Error reporting
MyTwitter
• For posting to Twitter
• Uses OAuth2
https://github.com/MyTwitter/MyTwitter
Wolfram Alpha
• Query's a ‘computational knowledge engine”
• More focused then a normal search engine
https://gist.github.com/willcodeforpizza/9f0ed4a641912ceda5d42eeab74129e3#file-get-wolframalphaquery-ps1
Chaining examples
Chain together to link information
• APIs are great by themselves to get data or automate
updating a system
• Most powerful when you start chaining them together
• Use API1 to feed into API2 into API3 etc…
Disk space report
Check disk
space on
local server
If space < 12%
If space < 5%
send email via
Mailgun API
send message
via Slack API
https://gist.github.com/willcodeforpizza/2dc839636aa2448f3a4b26d7a630e0cc#file-disksizereportemailslack-ps1
Disk space report
https://gist.github.com/willcodeforpizza/2dc839636aa2448f3a4b26d7a630e0cc#file-disksizereportemailslack-ps1
Get-HomeTime
Get my next
train via
National Rail
API
Get the next
bus after train
arrives from
bus API
Get weather
from Open
Weather API
to check rain
If I’m late,
email my
better half via
the Mailgun
API
Get-HomeTime
Automated documentation
Updates JIRA
ticket
Parse help
and run spell
check
Parse help
and shorten
URLs
Update wiki
Automated documentation
New-Employee
Query HR
system to get
user details
Create AD
user
Create in
Office 365
Add to
Salesforce
Add to
ticketing
system
Add to
finance
system
Update
profile on
ticketing
system
Security
Keep your keys secure!
• Search KEY_ID on Github: https://github.com/search?q=KEY_ID
• Result on first page:
• Uh-oh!
Storing API keys
• Powershell & Windows password store
• Powershell & Keepass module
• Store as an encrypted string
• Prompt the user
DON’T EMBED THEM IN A SCRIPT!
Encrypting JSON strings
https://gist.github.com/willcodeforpizza/a0a29c36d6cef18b1758d8754c2ff1dc#file-encrypt-json-secrets
Rejected slides
Avoid herestrings
• Harder to edit
• Really difficult to dynamically add fields
• More likely to make mistakes
• Looks a mess with big strings