Making MIDAS API Calls & Authentication

This page of the MIDAS API documentation explains how to make calls to the API. API calls to a MIDAS booking system can be made in a number of ways:

---

API calls via HTTP

To make an API call, your application will need to perform an HTTP POST transaction (HTTP GET requests can also be enabled - see API Settings) to http(s)://your_midas_url/api.pl.

Each request must include as a minimum:

1. Your unique MIDAS API key.
2. An API command.
3. All associated required parameters (if applicable) for the particular API command being issued.

The API key itself may be passed either in a GET / POST parameter named "key", or via an "X-API-KEY" HTTP header (recommended).

Please refer to the API Command Reference for details of available API commands and associated parameters.

---

API calls from the Command Line

In addition to making API calls via HTTP, the MIDAS API also permits calls to be made directly from the command line.

API calls made in this way have the added benefit of being significantly faster (assuming the call is made from the command line on the same server as the MIDAS system), as they do not require an HTTP transaction to be conducted.

To make API calls from the command line, simply call "api.pl" (located within your server's MIDAS directory) and pass API parameters & values via command line switches.

For example, to retrieve the currently installed version of MIDAS from the Windows command line (cmd):

...or from Windows PowerShell:

---

API calls from

Postman is a third party API development tool, helping developers build, test, collaborate and integrate APIs.

If you use Postman, we have a MIDAS API collection available for import. For more information, please see our KB article: Using the MIDAS API with Postman.

---

Keeping your API keys secure

Anyone who holds your API key can use the API against your MIDAS system, so treat it like a password.

• Do not publish it or commit it to source control, including private repositories that may later become public. Keep it in an environment variable or secrets manager. Deleting a key from a later commit does not remove it from the repository history, so replace the key instead.
• Send it in the X-API-KEY header rather than as a URL parameter, so it is not recorded in server logs, browser history or referrer data.
• Only share it with people who need it, and replace it when someone who had access leaves.
• If you think it has been exposed, rotate it immediately. Until you do, anyone who has it can keep using it.
• You are responsible for the security of your API key and for activity carried out using it.

---

Important information for Cloud-Hosted customers

---