HMAC Generation

This section provides descriptions and code examples of how to construct the HMAC Digest that is required to make an authenticated request to the Cloud9 APIs.

Every request to an API endpoint must be authenticated. Authentication is verified by Cloud9 through the customer providing an HMAC SHA512 signature that is generated with a public and private key created through the Cloud9 Portal.

The following description and code examples call for an HMAC SHA512 hash to be generated. This is not interchangeable with a SHA512 hash and submitting a SHA512 hash as the authentication to a request will cause it to be rejected. HMAC SHA512 is a well-defined standard for which Cloud9 never used custom libraries. Each code example in the following section details what standard library for the specified language is being used to generate the HMAC SHA512 hash.

All requests to REST endpoints must include an HMAC SHA512 authentication signature generated over the entirety of the request (headers and body) where the HMAC algorithm is salted with the secret key. This step allows Cloud9 to verify that the request has not been tampered with in transit.

The public key must be provided in every request allowing Cloud9 to verify the IP whitelist associated with the key against the source of the incoming request and that the key is valid and unexpired.

HMAC Signature

The Signature is an HMAC SHA512 hash of the entire contents of the request, including headers and body of the message. To generate the HMAC signature, you can use any standard HMAC SHA512 library in your preferred language. The API secret is used to seed the HMAC SHA512 hashing algorithm. The API key, along with the entire contents of the request (including headers and body) are combined into a string which is passed into the hashing algorithm. The resulting HMAC signature is provided in the Authentication header of the request and used by Cloud9 to verify that the customer's request is authentic and authorized.

HMAC Digest

The Digest is composed of four separate pieces: a prefix, the public API key used in the generation of the Signature, a globally unique identifier (guid), and the Signature.

The purpose of the Digest is for Cloud9 to verify both the authenticity and integrity of the request from a customer. To verify authenticity, Cloud9 compares the API public key against the key generated by the customer through the Cloud9 Portal. To verify message integrity, Cloud9 compares the Signature against a hash created on the received message with the customer’s public and private keys using the same methodology described on this page.

HMAC Signature and Digest Construction

The HMAC Signature is generated on the entirety of the request that will be sent to Cloud9, including all headers and the body of the request. To generate the HMAC Signature, the entire request should be provided in string format into your chosen HMAC library in the order specified as follows:

• request type (ex. ‘POST’)

• delimiter (ex. ‘\n’)

• ‘https’

• delimiter

• API URI and port (ex. ‘calldataapi.xhoot.com:443’)

• delimiter

• API endpoint (ex. ‘/v1/calls/metadata’)

• delimiter

• Content-Type (ex. ‘application/json’)

• delimiter

• API public key

• delimiter

• nonce (guid)

• delimiter

• request timestamp (ex. ‘Thu, 3 Dec 2019 05:27:23 GMT’)

• delimiter

• request body

• delimiter

As an example, a complete string on which the HMAC SHA512 hash should be created would appear as follows:

'POST\nhttps\ncalldataapi.xhoot.com:443\n/v1/calls/metadata\napplication/j son\n' + api_public_key + '\n' + nonce + '\nThu, 23 Apr 2020 17:45:11 GMT\n{"beginDate": "2020-01-27 20:19:00","endDate": "2020-01-27 21:51:00","pageSize": 1000}\n'

There are no specific requirements on the length or type of the nonce so long as it is globally unique. The nonce is provided to ensure variability so that no two requests have identical Signatures.

It is important that all fields provided in the string on which the hash is computed are identical to the values and formatting of those fields as they appear in the request to Cloud9. In particular:

• Ensure that the timestamp is generated once for the hash and message to avoid differences in the timestamp if it is generated separately for the hash and message.

• Ensure the nonce is generated once to avoid difference in the nonce if it is generated once for the hash and once for the Digest.

• Ensure that the body format is identical, paying particular attention to line feeds and carriage returns (if any) in the request body vs the body provided in the hash string.

Note that the request body is always required to compute the HMAC signature, even for requests that do not require a body (e.g. Monitoring API GET /userPresence). When an endpoint does not require a body, the request body should be set to a null (empty) string. Failing to do this will cause a signature mismatch when the request is checked, resulting in an HTTP 403.

As the body and date/times may change with each request, every new request to a Cloud9 API must have a newly computed HMAC Signature. An HMAC Signature generated from one request should never be used for another request as the request will be rejected for having an invalid Signature.

The HMAC Digest is the final value that will be provided in the Authorization header of the request. The Digest is composed as follows:

• Algorithm (ex. ‘HMACSHA512’)

• [space]

• API public key

• ‘:’

• nonce

• ‘:’

• HMAC Signature (as a Base64 string)

An example of a complete Digest which would be put into the Authorization header is as follows:

HmacSHA512 ZXlKMGVYQWlPaUpLVjFRaUxDSmhiR2NpT2lKSVV6VXhNaUo5LmV5SnpkV0lpT2lKRFlXeHNjeU JFWVhSaElpd2lZWFZrSWpvaU1UTWlMQ0poY0dsRmJuWWlPaUpRVWs5RUlpd2libUptSWpveE5U Z3dPRFl3T0RBd0xDSmhjR2xXWlhKemFXOXVJam9pTVM0d0xrZEJJaXdpYVhOeklqb2lZemtpTE NKbGVIQWlPakUyTVRJek9UWTRNREFzSW1saGRDSTZNVFU0TURreE1UazBObjAuRFNaTG9TU09a dzR0QUJEUnMzbWZ1QUVIRGZCRFNTR0xLbmJfUDRnTjFTZ0c2S09RdzlDcWZvdmxDNWlqbkoyM1 p3Q1lWTDNtYmNiOTBjRmFadURTbFE=:4b426367-7c46-4554-b4a7 dff043526862:Ldf+UUVyXf0moAz6quG5/KEHq2qLUSbczursglLa/on0ZTkgD3LQdtFJgWgG6 9MICOMJ/6fzbV2nh5Li/AK19w==

As previously mentioned, it is important that the nonce provided in the digest is the same nonce that was used in the Signature.

If a Digest is incorrectly formatted, the expected response is an HTTP 401. If a Signature does not match, the expected response is an HTTP 403. Cloud9 cannot determine the specific nature of what may be causing an invalid Digest or Signature. Under no circumstances should the API secret be transmitted to Cloud9 in any request.

Code Examples

The description and examples in this document demonstrate constructing the HMAC Digest for a Call Data API request, but the principles can be expanded to any of the Cloud9 APIs. As stated in the introduction, this section only provides details on the generation of the HMAC Digest. None of the code examples provide details of how an https request may be submitted to Cloud9 with the exception of the Javascript example.

JavaScript

The JavaScript code sample uses CryptoJS to calculate the HMAC. See https://cryptojs.gitbook.io for library details. It is up to the customer’s discretion how they prefer to make http requests – the following example uses Axios.

const uuid = require('uuid');
const moment = require('moment');
const axios = require('axios');
let CryptoJS = require('crypto-js');
require('axios-debug-log'); // optional
var ApiKey = "[YOUR API KEY]";
var ApiSecretKey = "[YOUR SECRET KEY]";

// production URL
const protocol = 'https';
const requestURI = 'calldataapi.xhoot.com:443';
const path = '/v1/calls/metadata';
const requestMethod = 'POST';
const contentType = 'application/json';
const requestTimeStamp = new Date().toUTCString();
const nonce = uuid.v4();
let requestBody = {
 "beginDate": "2020-02-18 19:00:01",
 "endDate": "2020-02-18 23:59:59",
 "pageSize": 20,
 "nextPageToken":"RusCsVCI2XRusCsDtI3XRdeCsPKI5XRusCsPKI10X"
};
const DELIM = '\n';

// encode to HMAC SHA 512
let hmac = CryptoJS.algo.HMAC.create(CryptoJS.algo.SHA512, ApiSecretKey);
hmac.update(requestMethod);
hmac.update(DELIM);
hmac.update(protocol);
hmac.update(DELIM);
hmac.update(requestURI);
hmac.update(DELIM);
hmac.update(path);
hmac.update(DELIM);
hmac.update(contentType);
hmac.update(DELIM);
hmac.update(ApiKey);
hmac.update(DELIM);
hmac.update(nonce);
hmac.update(DELIM);
hmac.update(requestTimeStamp);
hmac.update(DELIM);
let p = JSON.stringify(requestBody);
hmac.update(p);
hmac.update(DELIM);
let signatureBytes = hmac.finalize();
hmac.reset();
signatureBytes = CryptoJS.enc.Base64.stringify(signatureBytes);
let digest = "HmacSHA512 " + ApiKey + ":" + nonce + ":" + signatureBytes;
console.log("Digest to include in auth: " + digest);

// send request and get response
let resp = axios.post(protocol + '://' + requestURI + path,
 requestBody,
{ headers: {
 'Authorization': digest,
'Content-Type': contentType,
 'Date': requestTimeStamp
 }
 })
 .then(response =>
 console.log('Got response: ' + JSON.stringify(response.data))
 )
 .catch( error =>
 console.log(error)
 );

PHP

PHP has a native HMAC function as part of the language’s core libraries.

<?php
$api_key = '[YOU CLOUD9 API KEY]';
$api_secret '[YOU CLOUD9 API SECRET KEY]';
$nonce = uniqid("SOME IDENTIFIER I CHOOSE", true);
$now = 'Thu, 3 Dec 2019 05:27:23 GMT';

// JSON request
$json = '{"beginDate":"2019-02-08 22:23:32","endDate":"2019-10-09
22:23:32","pageSize":100}';
$url = ' calldataapi.xhoot.com:443';
$string_to_sign = 'POST' . "\n" .
 'https' . "\n" .
 $url . "\n" .
 '/v1/calls/metadata' . "\n" .
 'application/json' . "\n" .
 $api_key . "\n" .
 $nonce . "\n" .
 $now . "\n" .
 $json . "\n";
$digest = hash_hmac('sha512', $string_to_sign, $api_secret, true);
$header = 'Authorization: HmacSHA512 ' . $api_key . ':' . $nonce . ':' .
base64_encode($digest);
echo $header;

Java

This code example uses RestTemplate from the Spring framework but any HTTP client can be used.

package com.c9tec.apis.audit.samples.simple;

import org.springframework.http.HttpEntity;
import org.springframework.http.HttpHeaders;
import org.springframework.http.ResponseEntity;
import org.springframework.web.client.RestTemplate;
import javax.crypto.Mac;
import javax.crypto.spec.SecretKeySpec;
import javax.xml.bind.DatatypeConverter;
import java.io.IOException;
import java.nio.charset.StandardCharsets;
import java.security.InvalidKeyException;
import java.security.NoSuchAlgorithmException;
import java.util.UUID;

public class TestAuditApi {
 public void testAuditApi() throws IOException, InterruptedException, NoSuchAlgorithmException, InvalidKeyException {
  final String algorithm = "HmacSHA512";
  final String resource = "/v1/calls/metadata";
  final byte DELIMITER = '\n';
 
  String apiKey = "[YOUR CLOUD9 API KEY]";
  String method = "POST";
  String host = "calldataapi.xhoot.com";
  int port = 443;
  String scheme = "https";
  String apiSecret = "[YOUR CLOUD9 API SECRET KEY]";
  String dateString = "Wed, 18 Dec 2019 19:07:51 GMT"; 
  
  // generate date based on your preferred library
  HttpHeaders headers = new HttpHeaders();
  headers.set("Content-Type", "application/json");
  headers.set("Date", dateString);
  RestTemplate template = new RestTemplate();
  final String body = "{\"beginDate\":\"2019-02-08 22:23:32\"," +
  "\"endDate\":\"2019-10-09 22:23:32\"," + "\"pageSize\":100,"}";
  String nonce = UUID.randomUUID().toString();
  final Mac digest = Mac.getInstance(algorithm);
  SecretKeySpec secretKey = new SecretKeySpec(apiSecret.getBytes(), algorithm);
  
  digest.init(secretKey);
  digest.update(method.getBytes(StandardCharsets.UTF_8));
  digest.update(DELIMITER);
  digest.update(scheme.getBytes(StandardCharsets.UTF_8));
  digest.update(DELIMITER);
  digest.update((host + ":" + port).getBytes(StandardCharsets.UTF_8));
  digest.update(DELIMITER);
  digest.update(resource.getBytes(StandardCharsets.UTF_8));
  digest.update(DELIMITER);
 
  digest.update("application/json".getBytes(StandardCharsets.UTF_8));
  digest.update(DELIMITER);
  digest.update(apiKey.getBytes(StandardCharsets.UTF_8));
  digest.update(DELIMITER);
  digest.update(nonce.getBytes(StandardCharsets.UTF_8));
  digest.update(DELIMITER);
  digest.update(dateString.getBytes(StandardCharsets.UTF_8));
  digest.update(DELIMITER);
  digest.update(body.getBytes(StandardCharsets.UTF_8));
  digest.update(DELIMITER);
  final byte[] signatureBytes = digest.doFinal();
  digest.reset();
  
  final String signature = DatatypeConverter.printBase64Binary(signatureBytes);
  
  // build the header with the HMAC signature
  final String authHeader = algorithm + " " + apiKey + ":" + nonce + ":" + signature;
  headers.set("Authorization", authHeader);
  
  // send a sample request to a Cloud 9 service that uses HMAC
  HttpEntity<String> entity = new HttpEntity<>(body, headers);
  
  final ResponseEntity<String> response = template.postForEntity(scheme + "://" + host + ":" + port + resource,
  entity, String.class);
  
  System.out.println(response.getStatusCode());
  System.out.println(response.getBody());
 }
}

Python

This Python implementation makes use of the HMAC library and request library. Note that json.dumps(body) is used when generating the HMAC signature and again when sending the request. This ensures that the data is exactly the same in both the signature and the request body.

hmac — Keyed-Hashing for Message AuthenticationPython documentation

Requests: HTTP for Humans™ — Requests 2.34.2 documentationrequests.readthedocs.io

import requests, json, hmac, base64, uuid
from datetime import datetime
import hashlib
api_key = "public API key"
secret_key = "private API key"
body = {
    "beginDate": "2023-01-01 23:59:59",
    "endDate": "2023-02-03 00:00:01",
    "pageSize":100,
}
request_timestamp = datetime.utcnow()
def get_hmac_key(request_method, host, port, request_path, request_body, api_key, secret_key, request_timestamp, content_type='application/json'):
    nonce = uuid.uuid4().hex
    message = f'{request_method}\nhttps\n{host}:{port}\n{request_path}\n{content_type}\n{api_key}\n{nonce}\n{request_timestamp.strftime("%a, %d %b %Y %H:%M:%S GMT")}\n{json.dumps(request_body)}\n'
    signature = hmac.new(bytes(secret_key, 'UTF-8'), bytes(message, 'UTF8'), hashlib.sha512)
    return str(f"HmacSHA512 {api_key}:{nonce}:{base64.b64encode(signature.digest()).decode()}")
hmac_key = get_hmac_key('POST', 'calldataapi.xhoot.com', 443, '/v1/calls/metadata', body, api_key, secret_key, request_timestamp)
headers = {
    'Authorization': hmac_key,
    'Content-Type': 'application/json',
    'Date': request_timestamp.strftime("%a, %d %b %Y %H:%M:%S GMT")
}
response = requests.post("https://calldataapi.xhoot.com:443/v1/calls/metadata", headers=headers, data=json.dumps(body)).json()
print(response)

C#

This C# implementation is provided as a .NET Framework Console application for a Visual Studio app dev environment. The implementation makes use of a helper class to read in a separate apiKeys.txt file, which is provided after the code example below. This example makes use of the .NET System.Security.Cryptography library to provide the HMAC algorithm.

using System;
using System.Collections.Generic;
using System.IO;
using System.Linq;
using System.Net.Http;
using System.Security.Cryptography;
using System.Text;
using System.Threading.Tasks;

namespace c9api_dnf
{
 class Program
 {
 static void Main(string[] args)
  {
   Console.WriteLine("Starting Program");
  
   String responseContent = "";
  
   ApiKeyHelper apiKeyHelper = new ApiKeyHelper("ApiKeys.txt");
   Dictionary<string, string> apiKeyData = apiKeyHelper.reader();
   try
   {
    String now = DateTime.UtcNow.ToString("r");
    HttpClient client = new HttpClient();
    HttpRequestMessage request = new HttpRequestMessage(HttpMethod.Post, String.Format("https://calldataapi.xhoot.com:443/v1/calls/metadata"));
    String body = "{\"beginDate\":\"2021-01-02 00:00:00\",\"endDate\":\"2021-
 01-03 00:00:00\",\"pageSize\":1000,\"sortColumn\":\"stop\"}";
   request.Content = new StringContent(body, Encoding.UTF8, "application/json");
  
   String nonce = Guid.NewGuid().ToString();
  
   HMACSHA512 digest = new HMACSHA512(ASCIIEncoding.UTF8.GetBytes(apiKeyData["CALLDATA_API_SECRET_KEY"]));
   digest.Initialize();
   String digestContent =
 String.Format("POST\nhttps\ncalldataapi.xhoot.com:443\n/v1/calls/metadata\napplic
 ation/json\n{0}\n{1}\n{2}\n{3}\n", apiKeyData["CALLDATA_API_KEY"], nonce, now,
 body);
  
   byte[] signatureBytes =
digest.ComputeHash(UTF8Encoding.UTF8.GetBytes(digestContent));
   String signatureBase64 = Convert.ToBase64String(signatureBytes);
  
   String authHeader = String.Format("{0} {1}:{2}:{3}", "HmacSHA512", apiKeyData["CALLDATA_API_KEY"], nonce, signatureBase64);
   request.Headers.Add("Authorization", authHeader);
   request.Headers.Add("Date", now);
  
   HttpResponseMessage response = client.SendAsync(request).Result;
  
  // Best effort read the response, so we have it for any error handling.
   try
   {
    responseContent = response.Content.ReadAsStringAsync().Result;
    Console.WriteLine(responseContent);
   }
   catch (Exception)
   { }
   response.EnsureSuccessStatusCode();
   }
   catch (Exception ex)
   {
    Console.WriteLine(String.Format("Error getting call list: {0} {1}", responseContent, ex.ToString()), "Error getting call list...");
   }
  }
 }
 class ApiKeyHelper
 {
  string theApiFile = "";
  // Constructor
  public ApiKeyHelper(string theApiFile)
  {
   this.theApiFile = theApiFile;
  }
  public Dictionary<string, string> reader()
  {
   var data = new Dictionary<string, string>();
   foreach (var row in File.ReadAllLines(this.theApiFile))
    data.Add(row.Split('=')[0], string.Join("=", row.Split('=').Skip(1).ToArray()));
   return data;
  }
 }
}

ApiKeys.txt
CALLDATA_API_KEY=[YOUR CLOUD9 API KEY]
CALLDATA_API_SECRET_KEY=[YOUR CLOUD9 API SECRET KEY]

PowerShell

The following PowerShell example uses the System.Security.Cryptography library for the HMAC algorithm. It is important to Initialize() the HMAC object before using it, or an invalid signature will be generated.

$apiKey = "[YOUR CLOUD9 API KEY]"
$apiSecretKey = "[YOUR CLOUD9 API SECRET KEY]"

$nonce = [System.Guid]::NewGuid().Guid

$body = [PSCustomObject]@{
 beginDate = [DateTime]::UtcNow.AddDays(-1).ToString("yyyy-MM-dd HH:mm:ss")
 endDate = [DateTime]::UtcNow.ToString("yyyy-MM-dd HH:mm:ss")
 pageSize = 100
} | ConvertTo-Json -Compress

$requestTimeStamp = [DateTime]::UtcNow.ToString("r")

$payload = [String]::Format("POST`nhttps`ncalldataapi.xhoot.com:443`n/v1/calls/metadata`napplication/json`n{0}`n{1}`n{2}`n{3}`n", $apiKey, $nonce, $requestTimeStamp, $body);

$hmacsha = New-Object System.Security.Cryptography.HMACSHA512
$hmacsha.Key = [Text.Encoding]::UTF8.GetBytes($apiSecretKey)
$hmacsha.Initialize()

$signature =
$hmacsha.ComputeHash([System.Text.Encoding]::UTF8.GetBytes($payload))
$signature = [Convert]::ToBase64String($signature)

$digest = "HmacSHA512 $($apiKey):$($nonce):$($signature)"

Invoke-RestMethod "https://calldataapi.xhoot.com:443/v1/calls/metadata"
[calldataapi.xhoot.com] -Headers @{"Authorization"=$digest;
Date=$requestTimeStamp} -Method Post -ContentType "application/json;charset=utf8" -Body $body

Complete Message Exchange

For demonstration purposes, the following is a complete message exchange between a client requestor and the Cloud9 Monitoring API (audit endpoint). Sensitive information has been replaced with filler characters of the same type as would be expected in a real request/response.

11:50:47.881 [main] DEBUG com.c9tec.apis.audit.RequestLogger - URI
: http://localhost:8080/external/apis/audit
11:50:47.883 [main] DEBUG com.c9tec.apis.audit.RequestLogger - Method
: POST
11:50:47.883 [main] DEBUG com.c9tec.apis.audit.RequestLogger - Headers
: {Accept=[application/json, application/x-jackson-smile,
application/cbor, application/*+json], Authorization=[HmacSHA512
ZXlKMGVYQWlPaUpLVjFRaUxDSmhiR2NpT2lKSVV6VXhNaUo5LmV5SnpkV0lpT2lKQmRXUnBkQ0
lzSW1GMVpDSTZJakV6SWl3aVlYQnBSVzUySWpvaVZVRlVJaXdpYm1KbUlqb3hOVGMwTVRJeE5q
QXdMQ0poY0dsV1pYSnphVzl1SWpvaU1TNHdMa1ZCSWl3aWFYTnpJam9pWXpraUxDSmxlSEFpT2
pFMk1EVTJOVGMyTURBc0ltbGhkQ0k2TVRVM05ERTVNRGMzTlgwLlFPX2U5aG9MR19LdXZvTzNZ
R0daVUh3SE9jYk1yaTVWWldrSm55RnozN1VhR1V2TW0tdy1Sanh4SlRvelBzc1JzRWE5UktIaz
NlTGp1UHpjd1AwanpB:5c6c1800-0e15-4124-a822-
dbe7459c6c07:1Mj9IRbfbAz8dbQrPoyTMmkrST2Q7O+RLDobB8rVR0G2p+kLyAgF0UbsepYrd
2tbjuwb2o8rHYr8C46VCAA3BQ==], Date=[Sat, 30 Nov 2019 16:50:46 GMT], UserAgent=[Unit test client], Content-Type=[application/json;charset=UTF-8],
Content-Length=[117]}
11:50:47.883 [main] DEBUG com.c9tec.apis.audit.RequestLogger - Request
body: {"beginDateTime":"2019-11-06 14:25:00","endDateTime":"2019-11-06
14:25:59","userNames":null,"level":"INFO","pageSize":10}
11:50:47.883 [main] DEBUG com.c9tec.apis.audit.RequestLogger -
==========================request
end================================================
11:50:47.972 [main] DEBUG com.c9tec.apis.audit.RequestLogger -
============================response
begin==========================================
11:50:49.470 [main] DEBUG com.c9tec.apis.audit.RequestLogger - Status code
: 200 OK
11:50:49.470 [main] DEBUG com.c9tec.apis.audit.RequestLogger - Status text
: null
11:50:49.470 [main] DEBUG com.c9tec.apis.audit.RequestLogger - Headers
: {Set-Cookie=[JSESSIONID=2FD690A1BB5FA1D5FB13683748947787; Path=/;
HttpOnly], X-Content-Type-Options=[nosniff, nosniff], X-XSS-Protection=[1;
mode=block], Cache-Control=[no-cache, no-store, max-age=0, mustrevalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY],
Content-Type=[application/json;charset=UTF-8], TransferEncoding=[chunked], Date=[Sat, 30 Nov 2019 16:50:49 GMT]}
11:50:49.470 [main] DEBUG com.c9tec.apis.audit.RequestLogger -
=======================response
end=================================================
11:50:49.471 [main] DEBUG org.springframework.web.client.RestTemplate -
Response 200 OK
11:50:49.477 [main] DEBUG org.springframework.web.client.RestTemplate -
Reading to [com.c9tec.apis.audit.domain.AuditTrailResponse] AuditTrailResponse{version='1.0.GA', nextPageToken=null, beginDate=2019-
11-06T14:25:00Z, endDate=2019-11-06T14:44:00Z,
auditRecord=[FormattedAuditRecord{username='user1',
userIP='111.222.111.222', actionSummary='Login', actionDescription='Api
Token', actionPage='C9Trader application', actionTimestamp=2019-11-
06T14:44Z}, FormattedAuditRecord{username='user1',
userIP='111.222.111.222', actionSummary='Login', actionDescription='Api
Token', actionPage='C9Trader application', actionTimestamp=2019-11-
06T14:40:26Z}, FormattedAuditRecord{username='user2',
userIP='111.222.111.222', actionSummary='Login', actionDescription='Api
Token', actionPage='C9Trader application', actionTimestamp=2019-11-
06T14:38:31Z}, FormattedAuditRecord{username='user2',
userIP='111.222.111.222', actionSummary='Login', actionDescription='Login
failed: wrong password.', actionPage='C9Trader application',
actionTimestamp=2019-11-06T14:38:16Z},
FormattedAuditRecord{username='user3', userIP='111.222.111.222',
actionSummary='Login', actionDescription='Successful login with
password.', actionPage='https://c9portal2.xhoot.com/c9portal/',
actionTimestamp=2019-11-06T14:28:51Z},
FormattedAuditRecord{username='user3', userIP='111.222.111.222',
actionSummary='Login', actionDescription='Api Token', actionPage='C9Trader
application', actionTimestamp=2019-11-06T14:26:46Z},
FormattedAuditRecord{username='user4', userIP='111.222.111.222',
actionSummary='Login', actionDescription='Successful login with
password.', actionPage='C9Trader application', actionTimestamp=2019-11-
06T14:26:26Z}, FormattedAuditRecord{username='user4',
userIP='99.88.77.66', actionSummary='Login', actionDescription='Login
failed: wrong IP address', actionPage='C9Trader application',
actionTimestamp=2019-11-06T14:26:05Z},
FormattedAuditRecord{username='user3', userIP='99.88.77.66',
actionSummary='Login', actionDescription='Login failed: wrong IP address',
actionPage='C9Trader application', actionTimestamp=2019-11-06T14:26:05Z},
FormattedAuditRecord{username='user4', userIP='99.88.77.66',
actionSummary='Login', actionDescription='Login failed: wrong IP address', actionPage='C9Trader application', actionTimestamp=2019-11-06T14:25:45Z}]}