How to setup a Data Connection to the QRS API using Certificates on the June 2017 release or higher

[Andre_Sostizzo]

This article will show how to connect to the Qlik Sense Repository API through a Data Connection using Certificates.

Environment:

Qlik Sense Enterprise on Windows  

Resolution

1. Create a new data connection using the Qlik REST Connector
2. Add the URL of the QRS endpoint that you want to connect to:
   
   

    

   Note: Since we are connecting using Certificates, we need to use port 4242 (help.qlik.com reference)
   
   
3. Keep Auto detect response type selected to the default value
4. In the Authentication section, select Anonymous and Use certificate from file:
   
   

    

   Note: For the Certificate file location, the expected format is file.pfx pointing to the client certificate used by Qlik Sense. Do note that this is a filename and not a file location. The file system location of the file is determined by the CertificateDirectoryPath key in the Qlik REST connector config (C:\Program Files\Common Files\Qlik\Custom Data\QvRestConnector\QvRestConnector.exe.config). The default location where the Qlik REST connector will look for certificates is C:\ProgramData\Qlik\Sense\Engine\Certificates
   
   See article Export client certificate and root certificate to make API calls  for instructions on exporting certificates from the QMC
   
   Note: The Qlik REST connector requires a password on the exported certificates for security purposes.
   
   
5. For the Additional Request Parameters section, you will need to add in the following values:
   
   1. Query parameter:
      • Name: xrfkey
      • Value: 16 character alphanumeric string
        
        
   2. Query headers:
      • Name: X-Qlik-Xrfkey
      • Value: Same 16 character alphanumeric string from the xrfkey value
      • Name: X-Qlik-User
      • Value: X-Qlik-User: UserDirectory=<directory>; UserId=<userid>
        • This user will need to have the needed rights on the API endpoint. Using a RootAdmin account here is recommended.
        • Note: If using INTERNAL accounts, it is recommended to use the sa_api user rather than sa_repository. The sa_repository user is used by the Repository Service whereas the sa_api user is purpose built for use in API use cases. This allows better tracking through logs should you need to investigate what occurred on a system.
      • Name: Response-Type
      • Value: application/json
        
        Like so: 
        
        
6. Test the connection and save it when it is successful.