Creating a basic BigTime Session.

	{UserId: 'jsmith@example.com', Pwd: 'mother'}

Once that post is validated, you'll get a valid response back from the BigTime server.

	{firm: 'abc3-4567-fgr4', staffsid: 21, userid: 999, token: 'asdf-werq-3asdf-ase5-qfaw5e' ... }

You can use the firm/token for each of your subsequent calls to the BigTime api (note that the response contains more than the fields shown here and a complete list can be found at the bottom of this page). For example, to pull a list of projects that are valid for this firm (name/id only), you can use the following http call:

headers X-Auth-Token:asdf-werq-3asdf-ase5-qfaw5e ; X-Auth-Realm: abc3-4567-fgr4
HTTP GET /picklist/projects

Creating a Firm-Specific Session.

Note that the standard BigTime session will connect a user to the firm that they were (most-recently) logged into. Since the vast majority of BigTime users are members of only one firm, that behavior is (typically) enough. Some power users, however, have more than one BigTime subscription (eg - they belong to more than one BigTime firm).

For these users, you can include a firm in your session post. As long as the user is, in-fact, a valid member of that firm -- your session will be pre-set with access to the firm you specified in your post.

HTTP POST:  /session
POST CONTENT:  {UserId: 'jsmith@example.com', Pwd: 'mother', firm: 'abc-4547-gggg'}
HTTP RESPONSE:  {firm: 'abc-4547-gggg', staffsid: 21, userid: 999, token: 'asdf-werq-3asdf-ase5-xxx' ... (see below) }

User Session: Field Details

When you create a new user session (or link an existing session to a new firm), the response will contain the fields listed below. While you will need to use firm and token to access any of the other functions in the BigTime api, each session also returns some useful "user-specific" information.

Validating staffer rights.

Some parts of the API are protected by a staffer's system rights. While the API will not allow access to sections of BigTime that the staffer does not have rights to see, you may want to check a staffer's rights before attempting to call protected areas of the API to improve your user experience.

Calling the /session/IsPermitted end point will return a simple true/false value to let you know if your current staffer has access to any of the specific rights listed below.

HEADERS:  X-Auth-Token:{YourAPIToken}, X-Auth-Realm:{YourFirmId}
HTTP POST:  /session/IsPermitted/FinancialAdmin
HTTP RESPONSE:  200 if the user is permitted or 405 if the user is not permitted that user right.

Making Api Calls.

You can use the other pages in this document to try various calls to the api, and see the results live. Just click the LOGIN button at the top of this page, and we'll take care of adding headers to your request on-the-fly.

In addition, if you'd like to Make a GET/POST call manually, simply enter the relative URL in the form below and click the GET/POST buttons. We'll show the results of your call in the space below as well.