The Enterprise Mission Assurance Support Service (eMASS) Representational State Transfer (REST) Application Programming Interface (API) enables users to perform assessments and complete actions associated with system records. Register External Application (that use the eMASS API) New users will need to register an API key with the eMASS development team prior to accessing the site for the first time. The eMASS REST API requires a client certificate (SSL/TLS, DoD PKI only). Use the Registration endpoint to register the client certificate. Every call to the eMASS REST API will require the use of the agreed upon public key certificate and API key. The API key must be provided in the request header for all endpoint calls (api-key). If the service receives an untrusted certificate or API key, a 401 error response code will be returned along with an error message. Available Request Headers

key	Example Value	Description
api-key	api-key-provided-by-emass	This API key must be provided in the request header for all endpoint calls
user-uid	USER.UID.KEY	This User unique identifier key must be provided in the request header for all PUT, POST, and DELETE endpoint calls
		Note: For DoD users this is the DoD ID Number (EIDIPI) on their DoD CAC

Approve API Client for Actionable Requests Users are required to log-in to eMASS and grant permissions for a client to update data within eMASS on their behalf. This is only required for actionable requests (PUT, POST, DELETE). The Registration Endpoint and all GET requests can be accessed without completing this process with the correct permissions. Please note that leaving a field parameter blank (for PUT/POST requests) has the potential to clear information in the active eMASS records. To establish an account with eMASS and/or acquire an api-key/user-uid, contact one of the listed POC: