1. Press '+' to add a party that you want to give access to your service.
2. Fill in the SCSN code of the company. This has to be the same as their SCSN code in Isah. If it concerns a customer, this code can be found on the Customers form; if it is a supplier, you can find it on the Suppliers form.
3. Specify the Interface address. This is the address of the company's Interface Service; they will supply this to you.
4. Pick the access mode for this relation. There are three settings with which you can secure your data:
   • Blocked: Any company with this setting will be denied access.
   • Bearer: A company with the authentication type 'Bearer' needs a token to gain access to your environment. This token is supplied by you.
   • Basic: A company set to 'Basic' needs a username and password to gain access. Their username is always equal to their SCSN code.
5. After picking either 'Bearer' or 'Basic', click the key icon to generate a token or a password. This will be automatically entered into the relevant field and copied to your clipboard, so you can easily send it on to the company that needs it for their access.
6. Press the Save icon at the end of the row.

Whenever there is a call to the web interface, the caller is identified using the methods described above. The interface returns a '401 - Unauthorized':

• if there is no authorization in the message
• if the message contains a 'Basic' identification, but no matching customer or supplier can be found
• if the message contains a 'Bearer' identification, but no matching customer or supplier can be found

For any calls made to the interface, the system logs date, time, caller identity and the result.

If they are an authorized party, the interface still runs the following checks:

• When they connect to retrieve a message, the interface checks if the authenticated party matches the party to whom the message is addressed
• When they connect to leave a message, the interface checks if the authenticated party matches the sender of the attached SCSN message.

If these checks fail, access will be denied and a '403 - Forbidden' will be returned.