Getting Started with the Event Hub

Predix uses protocol buffers for publishing and subscribing to events.

1. To use gRPC for publishing and subscribing using gRPC, save the following .proto file as EventHub.proto to your project's working directory. This generates source code for the language you want to use to interact with the Event Hub service.

   syntax = "proto3";
   option java_multiple_files = true;
   option java_package = "com.ge.predix.eventhub";
   option java_outer_classname = "EventHubService";
   package predix.eventhub;
   
   
   // A Timestamp represents a point in time independent of any time zone
   // or calendar, represented as seconds and fractions of seconds at
   // nanosecond resolution in UTC Epoch time. It is encoded using the
   // Proleptic Gregorian Calendar which extends the Gregorian calendar
   // backwards to year one. It is encoded assuming all minutes are 60
   // seconds long, i.e. leap seconds are "smeared" so that no leap second
   // table is needed for interpretation. Range is from
   // 0001-01-01T00:00:00Z to 9999-12-31T23:59:59.999999999Z.
   // By restricting to that range, we ensure that we can convert to
   // and from  RFC 3339 date strings.
   // See [https://www.ietf.org/rfc/rfc3339.txt](https://www.ietf.org/rfc/rfc3339.txt).
   //
   // Example 1: Compute Timestamp from POSIX `time()`.
   //
   //     Timestamp timestamp;
   //     timestamp.set_seconds(time(NULL));
   //     timestamp.set_nanos(0);
   //
   // Example 2: Compute Timestamp from POSIX `gettimeofday()`.
   //
   //     struct timeval tv;
   //     gettimeofday(&tv, NULL);
   //
   //     Timestamp timestamp;
   //     timestamp.set_seconds(tv.tv_sec);
   //     timestamp.set_nanos(tv.tv_usec * 1000);
   //
   // Example 3: Compute Timestamp from Win32 `GetSystemTimeAsFileTime()`.
   //
   //     FILETIME ft;
   //     GetSystemTimeAsFileTime(&ft);
   //     UINT64 ticks = (((UINT64)ft.dwHighDateTime) << 32) | ft.dwLowDateTime;
   //
   //     // A Windows tick is 100 nanoseconds. Windows epoch 1601-01-01T00:00:00Z
   //     // is 11644473600 seconds before Unix epoch 1970-01-01T00:00:00Z.
   //     Timestamp timestamp;
   //     timestamp.set_seconds((INT64) ((ticks / 10000000) - 11644473600LL));
   //     timestamp.set_nanos((INT32) ((ticks % 10000000) * 100));
   //
   // Example 4: Compute Timestamp from Java `System.currentTimeMillis()`.
   //
   //     long millis = System.currentTimeMillis();
   //
   //     Timestamp timestamp = Timestamp.newBuilder().setSeconds(millis / 1000)
   //         .setNanos((int) ((millis % 1000) * 1000000)).build();
   //
   //
   // Example 5: Compute Timestamp from current time in Python.
   //
   //     now = time.time()
   //     seconds = int(now)
   //     nanos = int((now - seconds) * 10**9)
   //     timestamp = Timestamp(seconds=seconds, nanos=nanos)
   //
   //
   
   message Timestamp {
   
     // Represents seconds of UTC time since Unix epoch
     // 1970-01-01T00:00:00Z. Must be from 0001-01-01T00:00:00Z to
     // 9999-12-31T23:59:59Z inclusive.
     int64 seconds = 1;
   
     // Non-negative fractions of a second at nanosecond resolution. Negative
     // second values with fractions must still have non-negative nanos values
     // that count forward in time. Must be from 0 to 999,999,999
     // inclusive.
     int32 nanos = 2;
   }
    
   message Message {
     string id = 1; // Message ID - UUID
     bytes body = 2; // Payload from the Producer. there is also "Any" type, but its still under development
     string zone_id = 3;
     map<string, string> tags = 4; // Some general attributes, could potentially be used for tagging and others
     bytes key = 5;
     string topic = 6 ;
     int32 partition = 7 ;
     int64 offset    = 8 ;
     Timestamp timestamp = 9 ;
   }
    
   message Ack {
     string id = 1;
     AckStatus status_code = 2;
     string desc = 3;
     string topic = 4 ;  // this you will only get this the ack is a success
     int32 partition = 5 ; // this you will only get this the ack is a success
     int64 offset    = 6 ; // this you will only get this the ack is a success
     Timestamp timestamp = 7 ; // this you will only get this the ack is a success
     bytes body = 8 ; // you will only get this if the ack is a failure .
     string zone_id = 9; // you will only get this if the ack is a failure .
     map<string, string> tags = 10; // you will only get this if the ack is a failure .
     bytes key = 11; // you will only get this if the ack is a failure .
   }
    
   enum AckStatus {
     ACCEPTED = 0;
     BAD_REQUEST = 1;
     REQUEST_TOO_LARGE = 2;
     FAILED = 3;
   }
    
   message Messages {
     repeated Message msg = 1;
   }
    
   message PublishRequest {
     Messages messages = 1;
   }
    
   message PublishResponse {
     repeated Ack ack = 1;
   }
   
   message SubscriptionResponse {
     repeated Ack ack = 1 ;
   }
    
   message SubscriptionRequest {
     string zone_id = 1; // zone name, this will be the user's zone
     string subscriber = 2; // subscriber name, this will be utilized to parallelize processing
     string instance_id = 3; // particular instance of the subscriber 
   }
    
   // Publisher service definition
   service Publisher {
     // Send message to topic. Topic name will be in URI
     rpc send (stream PublishRequest) returns (stream PublishResponse) {}
   }
    
   // Subscriber service definition
   service Subscriber {
     // Receive message from a topic, as a subscriber
      rpc receive (SubscriptionRequest) returns (stream Message) {}
      rpc receiveWithAcks (stream SubscriptionResponse) returns (stream Message) {}
   }

2. Follow the directions at https://github.com/google/protobuf#protocol-compiler-installation to install the Protocol Buffer Compiler 3.0.0 for your system.
3. Generate source code in your language.
   1. Navigate to the directory where you saved the .proto file, then run the protoc command.
      The flags you use in the command depend on the language you are using. For example, if you are using Go, the command is:

      protoc --go_out=plugins=grpc:. *.proto

      If you are using Java, the command is:

      protoc --javaout=./target/classes/<package_path> ./src/main/proto/EventHub.proto

      Once the protoc command executes successfully, you should see the file that was generated, which contains EventHub in the name. The generated output depends on the language you are working in.

      The following table shows some examples:

      Language	Generated Output	References
      Go	.pb.go file with a type for each message type in your file	https://github.com/golang/protobuf
      Java	.java file with a class for each message type, as well as special Builder classes for creating message class instances.	https://github.com/google/protobuf/tree/master/java
      Python	A module with a static descriptor of each message type in your .proto, which is then used with a meta class to create the necessary Python data-access class at runtime.	https://github.com/google/protobuf/tree/master/python

You can create multiple instances of the UAA service in your space.

1. Sign into your Predix account at https://www.predix.io.
2. Navigate to Catalog > Services, then click the User Account and Authentication tile.
3. Click Subscribe on the required plan.
4. Complete the fields on the New Service Instance page.

   Field	Description
   Org	Select your organization.
   Space	Select the space for your application.
   Service instance name	Enter a unique name for this UAA service instance.
   Service plan	Select a plan.
   Admin client secret	Enter a client secret (this is the admin password for this UAA instance). The client secret can be any alphanumeric string. Note: Record the client secret in a secure place for later use.
   Subdomain	(Optional) Enter a subdomain you might need to use in addition to the domain created for UAA. You must not add special characters in the name of the subdomain. The value of sub-domain is case-insensitive.

5. Click Create Service.

You must create and configure an Event Hub service instance before you can bind an application to the service.

1. Sign into your Predix account at https://www.predix.io.
2. Navigate to Catalog > Data Management, then click the Event Hub tile.
3. Choose the plan, then click Subscribe.
4. On the New Service Instance page, enter the following information:

   Field	Description
   Org	Selection our organization.
   Space	Select the space for your application.
   User account and authentication (UAA)	Select the UAA service instance to bind to your service instance, or click Subscribe to New UAA to create a new UAA service instance.
   Service Instance Name	Enter a unique name for your service instance.
   Select a Plan	Select a plan.

5. Click Create Service.
6. You can also use the Cloud Foundry CLI to create an Event Hub service instance.
   On Mac OS and Linux, use the following syntax:

   cf create-service predix-event-hub <plan> <my_event_hub_instance> -c '{"trustedIssuerIds":["<uaa_instance1_host>/oauth/token", "<uaa_instance2_host>/oauth/token"]}'
     

   On Windows, use the following syntax:

   cf create-service predix-event-hub <plan> <my_event_hub_instance> -c "{\"trustedIssuerIds\":[\"<uaa_instance1_host/oauth/token\", \"<uaa_instance2_host/oauth/token\"]}"

   where:

   • <plan> – The plan associated with a service.
   • <my_event_hub_instance> – the service instance you are creating.
   • "trustedIssuerIds" – The issuerID of your trusted issuer (UAA instance), such as https://13fa0384-9e2a-48e2-9d06-2c95a1f4f5ea.predix-uaa.grc-apps.svc.ice.ge.com/oauth/token. You can use a comma-separated list to specify multiple trusted issuers. You can retrieve this URL from the VCAP_SERVICES environment variable after binding your UAA instance to an application.

1. Bind your application to the new Event Hub service instance.

   cf bind-service <your_app_name> <event_hub_service_instance_name>

   The <event_hub_service_instance_name> instance is bound to your application.

2. Restage your application to ensure the environment variable changes take effect:

   cf restage <application_name>

3. To view the environment variables for your application, enter the following command:

   cf env <application_name>

   The command displays the environment variables, which contain the publish and subscribe endpoint URIs.

   "VCAP_SERVICES": {
   	"predix-event-hub-<service>": [{
   		"credentials": {
   			"publish": {
   				"protocol_details": [{
   					"protocol": "grpc",
   					"uri": "eventhub.<cf_host>:443",
   					"zone-token-scope": ["predix-event-hub.zones.<Predix-Zone-Id>.user", "predix-event-hub.zones.<Predix-Zone-Id>.grpc.publish"]
   				}, {
   					"protocol": "wss",
   					"uri": "wss://eventhub.<cf_host>/v1/stream/messages/",
   					"zone-token-scope": ["predix-event-hub.zones.<Predix-Zone-Id>.user", "predix-event-hub.zones.<Predix-Zone-Id>.wss.publish"]
   
   				}],
   				"zone-http-header-name": "Predix-Zone-Id",
   				"zone-http-header-value": "<Predix-Zone-Id>"
   			},
   			"subscribe": {
   				"protocol_details": [{
   					"protocol": "grpc",
   					"uri": "eventhub.<cf_host>:443",
   					"zone-token-scope": ["predix-event-hub.zones.<Predix-Zone-Id>.user", "predix-event-hub.zones.<Predix-Zone-Id>.grpc.subscribe"]
   				}],
   				"zone-http-header-name": "Predix-Zone-Id",
   				"zone-http-header-value": "<Predix-Zone-Id>"
   			}
   		},
   		"label": "predix-event-hub",
   		"name": "sample-event-hub-app",
   		"plan": "Beta",
   		"provider": null,
   		"syslog_drain_url": null,
   		"tags": ["predix-event-hub", "eventhub", "event hub"]
   	}]
   }

You can create OAuth2 clients with specific permissions for your application to work with Predix Platform services. Often this is the first step after creating an instance of a service.

1. In the Predix.io Console view, select the Space where your services are located.
2. In the Services Instances page, select the UAA instance to configure.
3. Select the Configure Service Instance option.
4. In the UAA Dashboard login page, specify your admin client secret and click Login.
5. In UAA Dashboard, select the Client Management tab.
   The Client Management tab has two views, Clients and Services . The Services view displays the service instances that you have created for your services.

   Note: The service instances displayed in the Services view were created while using the UAA that you are trying to configure. Service instances that you created using other UAA instances are not displayed on this page.
6. Click Create Client to open the Create Client form.
7. Complete the Create Client form.

   Field	Description
   Client ID	Specify a name for the OAuth2 client you are creating.
   Authorized Grant Types	Choose one or more of the following grant types: authorization_code When you use the authorization code grant type, the client directs the resource owner to UAA, which in turn directs the resource owner back to the client with the authorization code. client_credentials When you use the client credentials grant type, the OAuth2 endpoint in UAA accepts the client ID and client secret and provides Access Tokens. password When you use the resource owner password credentials grant type, the OAuth2 endpoint in UAA accepts the username and password and provides Access Tokens. refresh_token The refresh tokens are credentials used to obtain access tokens. You can choose this option to obtain refresh token from UAA. You can then use the refresh token to obtain a new access token from UAA when the current access token becomes invalid or expires, or to obtain additional access tokens with identical or narrower scope. implicit When you use the implicit grant type, UAA directly issues an Access Token to the client without authenticating the client. This reduces the number of round trips required to obtain an access token. For more information on grant types, see RFC 6749.
   Client Secret	Specify the password. It is important that you keep a note of this password. If lost, this password cannot be retrieved.
   Confirm Client Secret	Reenter the client secret.
   Redirect URI	Specify a redirect URI to redirect the client after login or logout (for example, http://example-app.com/callback). Use this URI when you start using UAA as the service provider for your external Identity provider. UAA uses the value of Redirect URI for /oauth/authorize and /logout endpoints. You must specify a Redirect URI value if you use the Authorization Code or Implicit authorization grant type. When you use the Authorization Code grant type, the Redirect URI is your application's endpoint or callback that expects user authorization code. When you use the Implicit grant type, the Redirect URI is the end point where UAA sends the bearer token. Unique Resource Identifier consists of: Access Protocol, http or https Domain or IP address Access Port such as 80 or 443 Path If you have a specific URL for your application callback, you can use that to set the Redirect URI value for the related client. For example, https://your-app-domain.run.aws-usw02-pr.ice.predix.io/path1/path2/callback. You can specify multiple values for Redirect URI as a list of allowed destinations that UAA server can redirect the users. For example, https://yourappdomain1.run.aws-usw02-pr.ice.predix.io/path1/path2/callback, https://yourappdomain2.run.aws-usw02-pr.ice.predix.io/path1/path2/callback. If the subdomain of your application is dynamic, you can set the value of Redirect URI using wilcards. For example, https://*.your-app-domain.run.aws-usw02-pr.ice.predix.io/path1/path2/callback. Note: You must only use ‘*’ for a domain that is exclusive to your application (Such as your-app-domain in example above). This prevents the redirect to be routed to an application that you do not own. You cannot use * in the top domain and sub domain (such as predix.io in the example above).
   Scopes	Scopes are permissions associated with an OAuth Client to determine user access to a resource through an application. The user permissions are for authorization grant types authorization_code, password and implicit. By default, the admin client is assigned all required scopes. For a new client, an administrator can select the scopes to be added based on client requirements. For a list of available scopes, see Scopes Authorized by the UAA. To use an OAuth2 client for your Predix Platform service instance, you must update your OAuth2 client to add scopes that are specific to each service after adding the client to the service instance.
   Authorities	Authorities are permissions associated with the OAuth Client when an application or API is acting on its own behalf to access a resource with its own credentials, without user involvement. The permissions are for the client_credentials authorization grant type. By default, the admin client is assigned all required authorities. For a new client, an administrator can select the authorities to be added based on client requirements. The list of authorities matches the list of scopes. For a list of available UAA scopes, see Scopes Authorized by the UAA. To use an OAuth2 client for your Predix Platform service instance, you must update your OAuth2 client to add authorities that are specific to each service after adding the client to the service instance. Note: An admin client is not assigned the default authority to change the user password. To change the user password, you must add the uaa.admin authority to your admin client.
   Auto Approved Scopes	Specify scopes that can be approved automatically for the client without explicit approval from a resource owner.
   Allowed Providers	Specifies the names of the external identity providers, if any. This field is required if you are using external identity providers with UAA as a service provider.
   Access Token Validity	Specifies the access-token expiration time in ms.
   Refresh Token Validity	Specifies the refresh-token expiration time in ms.

To use an OAuth2 client for secure access to your Predix Platform service instance from your application, you must update your OAuth2 client to add additional authorities or scopes that are specific to each service.

1. In the Console view, select the Space where your services are located.
2. In the Services Instances page, select the UAA instance to configure.
3. Select the Configure Service Instance option.
4. In the UAA Dashboard login page, specify your admin client secret and click Login.
5. In UAA Dashboard, select the Client Management tab.
   The Client Management tab has two views, Clients and Services. The Services view displays the service instances that you have created for your services.

   Note: The service instances displayed in the Services view are the instances that you created using the UAA that you are trying to configure. The service instances that you created using some other UAA instance are not displayed on this page.
6. Select the Switch to Services View option.
7. In the Services view, select the service that you need to update.
8. Choose an existing client or choose the Create a new client option. If you chose to create a new client, follow the steps in uaas-managing-clients.html#task_79a81b74-552e-4f74-abfc-bd37e6adac87.
9. Click Submit.
10. Click on the Switch to Clients View option.
11. In the Clients view, click the edit icon corresponding to the client added in the previous step.
12. Complete the Edit Client form.

    Field	Description
    Authorized Grant Types	Choose one or more of the following grant types: authorization_code When you use the authorization code grant type, the client directs the resource owner to UAA, which in turn directs the resource owner back to the client with the authorization code. client_credentials When you use the client credentials grant type, the OAuth2 endpoint in UAA accepts the client ID and client secret and provides Access Tokens. password When you use the resource owner password credentials grant type, the OAuth2 endpoint in UAA accepts the username and password and provides Access Tokens. refresh_token The refresh tokens are credentials used to obtain access tokens. You can choose this option to obtain refresh token from UAA. You can then use the refresh token to obtain a new access token from UAA when the current access token becomes invalid or expires, or to obtain additional access tokens with identical or narrower scope. implicit When you use the implicit grant type, UAA directly issues an Access Token to the client without authenticating the client. This reduces the number of round trips required to obtain an access token. For more information on grant types, see RFC 6749.
    Redirect URI	Specify a redirect URI to redirect the client after login (for example, http://example-app.com/welcome). This URI is used when you start using UAA as service provider for your external Identify provider.
    Scopes	By default, the client is assigned a few required scopes. For a new client, an administrator can select the scopes to be added based on the selected grant type. If you select the authorization_code, password and implicit grant type, you must update the scopes with service specific scopes. For a complete list of required scopes, see uaas-managing-clients.html#reference_ec1_t3d_bx. For a list of available UAA scopes, see Scopes Authorized by the UAA.
    Authorities	By default, the client is assigned a few required authorities. For a new client, an administrator can select the authorities to be added based on the selected grant type. If you select the client_credentials grant type, you must update the authorities with service specific authorities. For a complete list of scopes to be added for each service, see uaas-managing-clients.html#reference_ec1_t3d_bx. For a list of available UAA authorities, see Scopes Authorized by the UAA.
    Auto Approved Scopes	Specify scopes that can be approved automatically for the client without explicit approval from the resource owner.
    Allowed Providers	Specify the names of the external identity providers, if any. This field is required if you are using external identity providers with UAA as a service provider.
    Access Token Validity	Specifies the access token expiration time in ms.
    Refresh Token Validity	Specifies the refresh token expiration time in ms.

Enable applications to access Event Hub by adding the Predix zone scopes.

1. Update your OAuth2 client with the following zone token scopes for publish:
   The below example shows publish zone token scopes from VCAP credentials for publishing using the WebSocket protocol:

   "zone-token-scopes":[  
                        "predix-event-hub.zones.<Predix-Zone-Id>.user",
                        "predix-event-hub.zones.<Predix-Zone-Id>.wss.publish"
                     ]

   uaac client update [client_name] 
       --authorities "uaa.resource predix-event-hub.zones.<Predix-Zone-Id>.user predix-event-hub.zones.<Predix-Zone-Id>.wss.publish" 
       --scope "uaa.resource predix-event-hub.zones.<Predix-Zone-Id>.user predix-event-hub.zones.<Predix-Zone-Id>.wss.publish" 
       

   The following example shows publish zone-token scopes from VCAP credentials for publishing using gRPC:

   "zone-token-scopes":[  
                        "predix-event-hub.zones.<Predix-Zone-Id>.user",
                        "predix-event-hub.zones.<Predix-Zone-Id>.grpc.publish"
                     ]

   uaac client update [client_name] 
       --authorities "uaa.resource predix-event-hub.zones.<Predix-Zone-Id>.user predix-event-hub.zones.<Predix-Zone-Id>.grpc.publish" 
       --scope "uaa.resource predix-event-hub.zones.<Predix-Zone-Id>.user predix-event-hub.zones.<Predix-Zone-Id>.grpc.publish" 
       

2. Update your OAuth2 client with the following zone token scopes for subscribe.
   The below example shows subscribe zone-token-scopes from VCAP credentials:

   "zone-token-scopes":[  
                        "predix-event-hub.zones.<Predix-Zone-Id>.user",
                        "predix-event-hub.zones.<Predix-Zone-Id>.grpc.subscribe"
                     ]

   uaac client update [client_name] 
       --authorities "uaa.resource predix-event-hub.zones.<Predix-Zone-Id>.user predix-event-hub.zones.<Predix-Zone-Id>.grpc.subscribe" 
       --scope "uaa.resource predix-event-hub.zones.<Predix-Zone-Id>.user predix-event-hub.zones.<Predix-Zone-Id>.grpc.subscribe" 
       

1. To add zone token scopes to a server-side application:
   1. Create two Oauth clients (one for publishing and one for subscribing) on any of the trusted issuers that were provided when you created the service instance.
   2. Add the publish zone token scopes from the VCAP credentials for the respective clients to their authorities.
      The following example displays publish zone token scopes from VCAP credentials for publishing using the WebSocket protocol:

      "zone-token-scopes":[  
                           "predix-event-hub.zones.<Predix-Zone-Id>.user",
                           "predix-event-hub.zones.<Predix-Zone-Id>.wss.publish"
                        ]

      The following example shows publish zone-token scopes from VCAP credentials for publishing using GRPC:

      "zone-token-scopes":[  
                           "predix-event-hub.zones.<Predix-Zone-Id>.user",
                           "predix-event-hub.zones.<Predix-Zone-Id>.grpc.publish"
                        ]

   3. Add the subscribe zone token scopes from the VCAP credentials for the respective clients to their authorities.
      The below example shows subscribe zone-token-scopes from VCAP credentials:

      "zone-token-scopes":[  
                           "predix-event-hub.zones.<Predix-Zone-Id>.user",
                           "predix-event-hub.zones.<Predix-Zone-Id>.grpc.subscribe"
                        ]

2. To add zone token scopes to a single-page web application that uses client-side JavaScript to consume the Event Hub service instance:
   1. Create two user groups for both publishing and subscribing.
   2. Add the user who needs access to the application to the appropriate groups for publish and subscribe.
      For example, for publishing over WebSocket, create two groups with the following names:

      "zone-token-scopes":[  
                           "predix-event-hub.zones.<Predix-Zone-Id>.user",
                           "predix-event-hub.zones.<Predix-Zone-Id>.wss.publish"
                        ]

      For publishing over gRPC, create two groups with the following names:

      "zone-token-scopes":[  
                           "predix-event-hub.zones.<Predix-Zone-Id>.user",
                           "predix-event-hub.zones.<Predix-Zone-Id>.grpc.publish"
                        ]

   3. For subscribers, create two groups with the following names:

      "zone-token-scopes":[  
                           "predix-event-hub.zones.<Predix-Zone-Id>.user",
                           "predix-event-hub.zones.<Predix-Zone-Id>.grpc.subscribe"
                        ]

3. You must also update your OAuth client scopes with the respective zone token scopes.

   See uaas-managing-clients.html#task_79a81b74-552e-4f74-abfc-bd37e6adac87 and uaas-managing-users.html#task_lrr_n5w_fs.

To publish or subscribe to messages in Event Hub by using gRPC, you must first create a client that can call the publishing and subscribing methods on Event Hub.

1. Create the client stub.
   gRPC client initialization varies depending on the language you are working with. You can review the gRPC tutorial for your chosen language at http://www.grpc.io/docs/tutorials/. For information on setting up gRPC with C++, see ehs-getting-started.html#task_3a498117-6e49-4187-8f94-420571a1ef3c.
   For example, in Go, you can connect toEvent Hub by creating a client connection like the following:

   conn, err := grpc.Dial(target, options)

   Note: You must dial the gRPC connection using TLS, as it is enabled with server authentication in Event Hub. See the guide at http://www.grpc.io/docs/guides/auth.html to see how this can be done for the language you are using.

   When dialing a gRPC connection, use the publish and subscribe URIs from the environment variables for your application as the target.

   You can find the publish and subscribe URIs in the VCAP environment variables. To see the VCAP environment variables, enter the following command:

   cf env <application_name>

   The VCAP environment variables are returned to you, using a format similar to the following example:

   "VCAP_SERVICES": {
   	"predix-event-hub-service-instance": [{
   		"credentials": {
   			"publish": {
   				"protocol_details": [{
   					"protocol": "grpc",
   					"uri": "eventhub.<cf_host>:443",
   					"zone-token-scope": ["predix-event-hub.zones.<Predix-Zone-Id>.user", "predix-event-hub.zones.<Predix-Zone-Id>.grpc.publish"]
   				}, {
   					"protocol": "wss",
   					"uri": "wss://eventhub.<cf_host>/v1/stream/messages/",
   					"zone-token-scope": ["predix-event-hub.zones.<Predix-Zone-Id>.user", "predix-event-hub.zones.<Predix-Zone-Id>.wss.publish"]
   
   				}],
   				"zone-http-header-name": "Predix-Zone-Id",
   				"zone-http-header-value": "<Predix-Zone-Id>"
   			},
   			"subscribe": {
   				"protocol_details": [{
   					"protocol": "grpc",
   					"uri": "eventhub.<cf_host>:443",
   					"zone-token-scope": ["predix-event-hub.zones.<Predix-Zone-Id>.user", "predix-event-hub.zones.<Predix-Zone-Id>.grpc.subscribe"]
   				}],
   				"zone-http-header-name": "Predix-Zone-Id",
   				"zone-http-header-value": "<Predix-Zone-Id>"
   			}
   		},
   		"label": "predix-event-hub",
   		"name": "sample-event-hub-app",
   		"plan": "Beta",
   		"provider": null,
   		"syslog_drain_url": null,
   		"tags": ["predix-event-hub", "eventhub", "event hub"]
   	}]
   }

2. Before publishing or subscribing to messages, you must send the following metadata from the client to Event Hub.

   authorization: <OAuth2 token from UAA instance trusted issuer> 
   predix-zone-id: <Predix-Zone-Id>  (same as service instance id and topic) 
   content-type: application/grpc

   The way you get your OAuth2 token depends on the kind of authorization grant type you are using. See Using UAA to Obtain OAuth2 Access Tokens for more information. If you are unsure of what authorization grant type you should use, you should obtain a token using the client credentials grant. See uaas-understanding.html#concept_ybx_dtv_hv.
   Note: HTTP/2 does not support capitalization in header keys, so Authorization does not work. Use authorization instead.
   The way this data is sent varies according to language type. For example, in Go, on an open client connection you can create a NewPublisherClient/NewSubscriberClient instance and send content in the form of a Context type with metadata added to the Context type.