[ARIN-Suggestions] Two Suggestions are now closed

[ARIN]

New responses from ARIN have been posted for the following suggestions, and these suggestions are now closed. You may find the original suggestions and the responses from ARIN below.

2022.5: Alternative to API Token in REST calls
2022.11: RESTful API Improvements

Regards,
American Registry for Internet Numbers (ARIN)

-----------

ACSP Suggestion 2022.5: Alternative to API Token in REST calls
www.arin.net/participate/community/acsp/suggestions/2022/2022-05/

Author: Anonymous   

Submitted On: 11 February 2022

Description:

Alternative to sending API Token as URL parameter in REST calls.

Either sending as POST form data or as an HTTP header field would be preferable as those should not tend to be logged in production systems.

Some other implementations of REST interfaces are using X-CSRFToken in the HTTP header field.

e.g. curl -H “X-CSRFToken: $myToken” -X GET https://my.fqdn/noun

Value to Community: Logging systems often log the entire URL and hence unnecessarily expose the API token to anyone with access to and reading the logs. This could accidentally lead to a security incident caused by unauthorized access to ARIN resources from a valid hijacked token.

Status: Closed

ARIN Comment: 

Thank you for your suggestion, numbered 2022.5, asking that ARIN consider alternatives to sending the API token as a URL parameter in REST calls to improve security. On 28 July 2026, a favored alternative was deployed, and ARIN now supports REST calls sent with the Authorization: ApiKey <API_KEY> header. ARIN will continue to accept API tokens as a URL parameter in REST calls.

Because this work is completed, we are closing this suggestion.

Thank you for participating in the ARIN Consultation and Suggestion Process.

-----------
ACSP Suggestion 2022.11: RESTful API Improvements
www.arin.net/participate/community/acsp/suggestions/2022/2022-11/

Author: Anonymous   
Submitted On: 15 April 2022

Description: Add support for non-human “service account” users for programmatic integrations with ARIN’s RESTful API.

Value to Community: Feeds automation efforts by community at large.

Timeframe: Not specified

Status: Closed

ARIN Comment:

Thank you for your suggestion, numbered 2022.11, asking that ARIN allow non-human “service accounts” to be used for programmatic interactions with ARIN’s RESTful API. On 28 July 2026, the restrictions at account creation preventing non-human “service accounts” have been removed, and ARIN now accepts such accounts.

Because this work is completed, we are closing this suggestion.

Thank you for participating in the ARIN Consultation and Suggestion Process.