Securely Passing Veeva vault session id to external API from a Veeva notification message
Answered
There is already an integration in place between Veeva Vault & our application for signing a vault document. Current integration doesn’t send any notification within the veeva vault to sign the document. Currently, Signer is getting notification in his email & Signing the document through the link provided in email. We have a business use case where customers want to see signing request notification within veeva vault & allow users to sign it from there.
We have created a Veeva Vault Java SDK package for implementing this use case. Custom veeva SDK is getting called when there is any change in state of a custom “Signatory” object defined in Veeva Vault. Custom SDK is generating a notification message for all the signers & this message contains a hyperlink. An external API needs to be called on click of hyperlink given in notification message which will allow signer to sign the document. This external API needs a Veeva vault Session id in order to validate the Signer's session. Currently, we are not able to pass the Veeva vault session id to external API on click of a link provided in notification message. Is there any way to call custom SDK on click on link provided in notification message or dynamically generate the session id on click of this link so that same session id can be passed to external API?
Below are sample of notification message and template created for this solution
-
Official comment
Hi,
Sending the session id as a query parameter is not secure and is not supported. There are two ways you can handle the session id.
The first is using a web tab and using postMessage to send the session id to an external URL.
https://developer.veevavault.com/docs/#sending-session-ids-with-post-messageThe second is sending the session id in a Spark message to an external endpoint. This would require the middleware to create an email notification.
https://developer.veevavault.com/sdk/#spark-messaging -
Thank you Thomas for responding. We have explored the options suggested by you.
Spark messaging and Job Operations are not suitable for our requirement, as we need to call an external API based on user action.
We have explored the Web Tab approach. Web Tab is always getting displayed to user. Is it possible to Show/Hide the tab dynamically based on user action?
Web tab should only be visible when user clicks on the Hyperlink present in the Veeva Notification message. Once user action is performed on the External URL, web tab should no longer be visible.
Usecase:
- A custom Web Tab is created.
- Notification is triggered using Veeva SDK Notification Service and the notification text contains the web tab address (https://{{vaultDNS}}/ui/#t/{{webTabId}}?queryParam=stringValue)
- When User clicks on the notification hyperlink, user is redirected to the Web tab page and can perform the required action through the external api.
Created below web tab
Following Notification message is triggered on update of a custom object data by using Veeva Vault SDK Notification Service.
On clicking the Notification message hyyperlink ( Click to Sign ), external API is invoked and user is prompted to ESign the document.
0 -
Hi,
As mentioned in my previous comment, the Web Tab (named 'Test Esign' in my screenshots above) is always getting displayed to the user. Is it possible to Show/Hide the tab dynamically based on user action? It should be hidden by default and it should show up only when the user clicks on the notification hyperlink to the web tab(https://{{vaultDNS}}/ui/#t/{{webTabId}}?queryParam=stringValue). user should be redirected to the Web tab page and can perform the required action through the external api.
Thanks,
Pavan
0 -
Dynamically controlling access to a web tab is not supported.
Another solution you can use that supports postMessage, is a web section on an object page layout.
https://platform.veevavault.help/en/gr/26387/#about-web-sections
https://developer.veevavault.com/mdl/#creating-web-sectionsThe section will always be present, similar to a web tab, but it may be more suitable aesthetically.
0 -
Hi Isak,
Thanks for all your help on this issue this far. We just have one final question and hoping you can help us out here.
We have implemented it using a custom user task & Web Action. User clicks on this task to navigate the object page. Then executes the Web Action to make an external API call.
Veeva SDK Record Trigger(BEFORE_UPDATE, BEFORE_INSERT) is used to create a new task record for a custom user task object and update the current record field with this newly created task id.
The Custom User task object (Object Class : User Task) inherits the default base User Task object (user_task__v).
List<Record> recordList = VaultCollections.newList();
RecordService recordService = ServiceLocator.locate(RecordService.class);
RecordBatchSaveRequest.Builder recordSaveRequestBuilder =
recordService.newRecordBatchSaveRequestBuilder();
Record r = recordService.newRecord(OBJECT_AS_AGREEMENT_ACTION);
r.setValue(FIELD_NAME, agreementName);
r.setValue(FIELD_AS_AGR_ACTION_ASSIGNED_TO, participantVaultUserId);
r.setValue(FIELD_AS_AGR_ACTION_AGREEMENT_ID, agreementId);
r.setValue(FIELD_AS_AGR_ACTION_LINK_SYS, senderName);
recordList.add(r);
recordSaveRequestBuilder.withRecords(recordList);
RecordBatchSaveRequest saveRequest = recordSaveRequestBuilder.build();
if (recordList.size() > 0) {
recordService.batchSaveRecords(saveRequest)
.onSuccesses(positionalRecordIds -> {
Optional<PositionalRecordId> firstRecord = positionalRecordIds.stream().findFirst();
if (firstRecord.isPresent()) {
PositionalRecordId recordId = firstRecord.get();
// Update the current participants record
newRecord.setValue(OBJECT_AS_AGREEMENT_ACTION, recordId.getRecordId());
}
})
.onErrors(batchOperationErrors -> {
batchOperationErrors.stream().findFirst().ifPresent(error -> {
String errMsg = error.getError().getMessage();
int errPosition = error.getInputPosition();
String name = recordList.get(errPosition).getValue("name__v", ValueType.STRING);
String message = "Agreement Id - "+ agreementId + " : Unable to create '" +
recordList.get(errPosition).getObjectName() + "' record: '" +
name + "' because of '" + errMsg + "'.";
logger.error(errMsg);
});
})
.execute();
}
}My Tasks page (Home > My Tasks ) is displaying all the tasks created through SDK code given above & task name is being displayed as hyperlink as shown below:
Our question is - Is it possible to append non-hyperlink text to this User Task name like “This task <<Hyperlink of task>> has been assigned to you by xyz person, please sign” in order to give a short instruction/description to the user?
0 -
This is not supported in Vault in general. The end user will have to navigate to the User Task record and view the description on the record. Though, you can customize the notification that gets sent out when you assign a task.
https://platform.veevavault.help/en/gr/40757/#notifications0
Please sign in to leave a comment.
Comments
6 comments