# General

## About AskMeFirst (AMF)

AskMeFirst is a platform that interfaces between Relaying Parties (RPs)/Requesters, Trusted Identity/Attribute Providers (Providers) and end users. The goal of AskMeFirst is to provide trusted familiar (Bank grade) authentication and consent to Requesting Parties as a service.

## Contents

* [Overview](#overview)
  * [Security concepts](#security-concepts)
  * [API Call Sequence Diagram](#api-call-sequence-diagram)
* [Authentication API](/askmefirst/authentication-api.md)
* [Supporting APIs](/askmefirst/supporting-apis.md)
  * [List Identity Providers API](/askmefirst/supporting-apis.md#list-identity-providers-api)
  * [Provider Template Fields API](/askmefirst/supporting-apis.md#provider-template-fields-api)
* [Consent APIs](/askmefirst/consent-apis.md)
  * [Consent Request](/askmefirst/consent-apis.md#consent-request)
  * [Consent Status](/askmefirst/consent-apis.md#consent-status)
  * [Consent Retry](/askmefirst/consent-apis.md#consent-retry)
  * [Consent History](/askmefirst/consent-apis.md#consent-history)

### Overview

#### Security concepts

#### Https

The API endpoints will be exposed over https only.

***

#### IP restrictions

The API’s will only allow IP addresses that are approved. The IP addresses for both the AMF System and the Organisational system/s are distributed as part of the Onboarding process.

***

#### Authentication

All APIs except the Authentication API will need a bearer token for authentication.

* Tokens are issued by the authentication service.
* Tokens must be kept confidential.
* Requests without a valid token will be rejected.
* Tokens will be in the form of a JWT Token (<https://datatracker.ietf.org/doc/html/rfc7519>) and will contain at a minimum an expiration claim (4.1.4) of the above specification.

**Required Headers**

| Header        | Value                   | Required |
| ------------- | ----------------------- | -------- |
| Authorization | `Bearer <access_token>` | Yes      |
| Content-Type  | `application/json`      | Yes\*    |

\* Required for requests with a body.

**Example Request**

```http
GET api/v1/example/123 HTTP/1.1
Host: api.example.com
Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...
```

***

#### API Call Sequence Diagram

This diagram illustrates the recommended order in which the APIs should be called to perform a complete consent workflow. It shows the sequence from authentication, through creating a consent request, checking its status, retrying if applicable, and retrieving consent history. The diagram helps developers understand the logical flow, dependencies between APIs, and the proper use of tokens and callbacks at each step.

<figure><img src="/files/RhnjIL4FIxxDX1DK8V6K" alt=""><figcaption></figcaption></figure>

***


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.comcorp.co.za/askmefirst/general.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.