User Stories

High level diagrams

Manufacturing process

Detailed flow

Login STB

Sequence overview

1. STB client calls the Entone API to get a signed JWT token
2. STB client calls the Move STB Authentication endpoint with the token and the public key

3. Move API verifies the supplied public key by checking against a stored (trusted) version of the Entone  public key

4. Move API verifies the JWT with the public key
5. Move API matches the supplied STB serial number to the user
6. Move API logs in the user

Logout STB

API to handle logout request of STB

Request

POST

https://boox.fi/api/stb/logout

POST Body

Please note that M is for Mandatory and O is for Optional. 

service_token

Headers

Please note that M is for Mandatory and O is for Optional.

Authorization: Bearer

Response

Link STB to a User

After user bought a STB this API need to be called. This API link or grant ownership of a STB to a user.

Request

POST

https://boox.fi/api/management/stb/link_user

POST Data Parameters

Please note that M is for Mandatory and O is for Optional.

serial_no

email

public_keys

Response

	"id": "123",
	"serial_no": "DNA-STB0001",
	"user": {
		"id": "10001",
		"email": "stb_user@dnastb.com"
	}
}

{
  "error" {
    "code": 9,
    "text": "Access to this resource is locked to IP addresses"
  }
}

Error Codes

Unlink STB from User

This API remove ownership of a STB from an user. Use cases: when user sells his/her device, when a device got stolen. 

Request

POST

https://boox.fi/api/management/stb/unlink_user

POST Data Parameters

Please note that M is for Mandatory and O is for Optional.

serial_no

email

Response

{
  "error" {
    "code": 9,
    "text": "Access to this resource is locked to IP addresses"
  }
}

Error Codes

Add New User Account

This API is used to add a new user account. Following rules apply:

• Email address or customer-id should not belong to any customer that is not in DELETED state; otherwise API will return an error.
• If the user with that email exists in DELETED state and his grace period is not expired, his previous registration state is restored.
• A new user is created in UNREGISTERED state.

Design Points (to be considered for future):

1. The main problem with making the two pin params as mandatory is that this feature is very specific to DNA requirements, while other frontends don't expect them. Therefore, we need a way so that both parties remain happy by giving a better design
2. For that we should make it configurable whether the two params are mandatory. So for DNA we will configure them as mandatory, so that if they are not provided by Visio when creating a new user API will return an error to provide the mandatory input param. While for others e.g. Delta we will configure them as optional so that if they don't provide the params, API will successfully create a user and set the pins in DB as NULL (empty). Also until DNA is not ready for the params to be mandatory we can keep it configured as optional for them
3. It is easy to implement from effort point of view and much flexible and reliable

Request

Query Strings

Please note that M is for Mandatory and O for Optional.

Error Codes

Edit Existing User Account

This API is used to suspend or activate a user account. It can also be used to change the email or customer-id of an existing account. Following rules apply:

• A user in DELETED state is not updated.
• "email" and "cid" parameters should not belong to any existing user, even if the user in in DELETED state
• If a user is suspended, his state is changed to DISABLED
• If a DISABLED user is activated and grace period has not expired, then previous registration state is restored, otherwise his state is changed to UNREGISTERED
• In other cases, if a user is activated, his state changed to REGISTERED.

Request

Querystrings

Please note that M is for Mandatory and O for Optional.

Error Codes