Desk's invoke API acts as a proxy between the extension and the External Services or Desk for calling the APIs.
With Desk Invoke API,
- Can access the Zoho Desk's APIs
- Can access the External Services's APIs
- Can access the Extension Data Specific APIs such as storage, configParam and log APIs
Using Desk Invoke API
The query parameters such as orgId , securityContext and headerparam HASH are required for calling Invoke API . orgId & securityContext will be provided by desk during the
Platform event callbacks. HASH should be generated using the SECRET and the Request URL inputs. Refer
Generating Hash for Invoke API
#INVOKE_API_REQUEST_PAYLOAD
URL : api/v1/invoke
RequestMethod : POST
QueryParams : orgId
RequestHeaders : HASH
Content-Type : application/x-www-form-urlencoded
RequestBody : #INVOKE_API_REQUEST_PAYLOAD.
ResponseCode : 200
Content-Type : application/json
Response : #INVOKE_API_RESPONSE_OBJECT
Generate Hash for Invoke API
To call invoke API, HASH is mandatory. Hash is used to verify the invoke API call was originally made by the extension developer. HASH is an
HMAC sha256 encrypted string with the key as app's secret (
manifest.secret) provided in the manifest and the input as invokeAPI's payload.
Desk also will generate the HASH with the shared app's secret with the provided payload in the invoke API and will match the provided HASH in the desk invoke API's header. If the HASH does not match with the desk generated HASH, then the invoke API will not be processed.
The same process of authentication can be used by the extension during the
extension callback events to verify the callback was originally sent by the desk.
Sample of Invoke API HASH Generation
If manifest.secret => "my_secret_key_238392"
For Sample Invoke API Inputs =>
requestType = POST
queryParams = {}
postBody = {}
headers = {"orgId":376723}
connectionLinkName = myConnectionLinkName
(*ignore what you don't need)'
Hash generation would be =>
then, generated HASH = hmac_sha256 ( stringToHash, "my_secret_key_238392" );

Note: While generating HASH, only include the parameters which will be used in the
invoke API.
Order of the fields while generating hash should be exactly
1.requestURL
2.requestType
3.queryParams
4.postBody
5.headers
6.connectionLinkName
and you can ignore the fields which you don't send.
Specifying Placeholders in Invoke API
You can specify configParams, authentication details as placeholders while calling the desk invoke API. The placeholders will be replaced with the original values before sending the request to requestURL.
Supported placeholders
Specifying Authentication Details in Invoke API
Invoke API applies the authentication details specified while calling the API, find the below table for specifying the authentication details while calling the invoke API.
Sample of Specifying Connection in invokeAPI payload
#INVOKE_API_RESPONSE_OBJECT
Sample Response :
{