> ## Documentation Index
> Fetch the complete documentation index at: https://docs.superoffice.com/llms.txt
> Use this file to discover all available pages before exploring further.

# How to use System User Client

> How to use the System User flow.

The WebAPI client library supports the System User flow. The client makes it very easy to call the online **PartnerSystemUserService endpoint**, validate the JWT and return the claims it contains.

The JWT contains a lot of information, however, it's usually just the Ticket credential that is interesting. Therefore, **SuperOffice.WebApi** simplifies calling the service, validating the response, and then returning the ticket in a single method call.

<Danger>
  Do **not** ask for a System User Ticket every single time you invoke an Agent method! This is a performance penalty. **Take advantage of the 6-hour window** and only ask for a new Ticket when absolutely necessary!
</Danger>

## SystemUserClient

Use the `SystemUserClient` class, located in the `SuperOffice.WebApi.IdentityModel` namespace.

The constructor accepts a `SystemUserInfo` instance and contains all of the information required to submit a request to the *partnersystemuserservice.svc* endpoint.

## SystemUserInfo properties

| Property          | Description                                        |
| ----------------- | -------------------------------------------------- |
| Environment       | The online environment (SOD, Stage, Production).   |
| ContextIdentifier | The tenant, or customer, identity.                 |
| ClientSecret      | The application secret, a.k.a. client\_secret.     |
| PrivateKey        | The applications RSAXML private certificate value. |
| SystemUserToken   | The SystemUser token, issued during app approval.  |

## Generate and send request

Given the required information, the `SystemUserClient` can generate and send a request to the service, then receive and validate the response.

```csharp theme={null}
var sysUserClient = new SystemUserClient(systemUserInfo);
var sysUserJwt = await sysUserClient.GetSystemUserJwtAsync();
var sysUserTkt = await sysUserClient.GetSystemUserTicketAsync();
```

The **GetSystemUserJwtAsync** only returns the JWT, wrapped in a `SystemUserResult`. It does not validate or extract any claims.

The **GetSystemUserTicketAsync**, validates the returned JWT, populates the `SystemUserClient.ClaimsIdentity` property, and returns the SOTicket credential.

## JWT validation

`GetSystemUserTicketAsync` is what consumers will use 99.9 percent of the time, but if there is a desire to skip the convenience, there are two alternatives for performing JWT validation.

**Alternative 1:**

Use the `ValidateSystemUserResult` method, and get back a `TokenValidationResult`.

This method also populates the `SystemUserClient.ClaimsIdentity` property. This method is used by `GetSystemUserTicketAsync`.

```csharp theme={null}
var tokenValidationResult = await sysUserClientValidateSystemUserResultAsync(systemUserResult);
```

**Alternative 2:**

Manually perform validation and extract claims, the `SystemUserClient` uses the `JwtTokenHandler`, located in the `SuperOffice.WebApi.IdentityModel` namespace.

```C# theme={null}
var handler = new SystemUserTokenHandler(
    new System.Net.Http.HttpClient(), // HttpClient instance.
    OnlineEnvironment.SOD             // target online environment (SOD, Stage, or Production)
    );

var tokenValidationResult = await handler.ValidateAsync(sysUserJwt.Token);
```

The `SystemUserTokenHandler.ValidateAsync` method returns a `TokenValidationResult`, a Microsoft datatype located in the [Microsoft.IdentityModel.JsonWebTokens][1] namespace, in the `Microsoft.IdentityModel.JsonWebTokens` assembly.

[1]: https://docs.microsoft.com/en-us/dotnet/api/microsoft.identitymodel.tokens.tokenvalidationresult


## Related topics

- [How to get a system user ticket credential](/en/api/authentication/online/auth-application/get-system-user-ticket.md)
- [How to sign system user token](/en/api/authentication/online/auth-application/sign-system-user-token.md)
- [How to use SuperOffice.WebApi](/en/api/web-services/proxies/superoffice-webapi/index.md)
- [How to create a user-defined field using the web services API](/en/api/web-services/howto/custom-objects/rest-create-udef-field.md)
- [How to set up a quote connector](/en/api/plugins/quote-connectors/set-up.md)
- [How user plans are constructed](/en/admin/license/dev/user-plans.md)