For the NiFi implementation of the Feeds, we are using CosmosDB REST API to write the documents. To date we have only used the SDK in accessing CosmosDB. Below are my findings while blazing the trail on how to use the REST API to create a document in CosmosDB using the REST API.

Reference

https://docs.microsoft.com/en-us/rest/api/documentdb/access-control-on-documentdb-resources?redirectedfrom=MSDN#resource-tokens
https://docs.microsoft.com/en-us/rest/api/documentdb/common-documentdb-rest-request-headers
https://docs.microsoft.com/en-us/rest/api/documentdb/documents
https://docs.microsoft.com/en-us/rest/api/documentdb/users
https://docs.microsoft.com/en-us/rest/api/documentdb/permissions

Master Key Tokens

The master key token is the all access key token that allows users to have full control of Cosmos DB resources in a particular account. The master key is created during the creation of an account. Master key Tokens DO NOT have access to Collections and documents when using the REST API the do have all access when using the SDK.

Resource Tokens

A Resource Token is created when users in a database are set up with access permissions for precise access control on a resource, also known as a permission resource. A permission resource contains a hash resource token specifically constructed with the information regarding the resource path and access type a user has access to. The permission resource token is time bound and the validity period can be overridden. When a permission resource is acted upon on (POST, GET, PUT), a new resource token is generated.

Header

There are 3 keys that are required when using the REST API with CosmosDB

Authorization

All REST operations, whether you’re using a master key token or resource token, must include the authorization header with the authorization string in order to interact with a resource. The authorization string has the following format:
type={typeoftoken}&ver={tokenversion}&sig={hashsignature} (Example: type=master&ver=1.0&sig=5mDuQBYA0kb70WDJoTUzSBMTG3owkC0/cEN4fqa18/s=)
*This token must be URL Encoded

Here at the details for each variable used in the Authorization string

type

Denotes the type of token: master or resource, both must be lower case and you specify master if you are using the Master Key in the creation of the signature or “resource” if you are using a resource token as you will see below.

ver

Denotes the version of the token, currently 1.0. (note a value of 1 also works)

sig

Denotes the hashed token signature.
The hash signature for a token is constructed from the following 4 parameters: Verb, ResourceType, ResourceLink and Date.
Verb: The Verb portion of the string is the HTTP verb, such as GET, POST or PUT.
ResourceType: The ResourceType portion of the string identifies the type of resource that the request is for, Eg. “dbs”, “colls”, “docs”, “users”, “permissions”, etc..(any resource name in Cosmos)
ResourceLink: The ResourceLink portion of the string is the identity property of the resource that the request is directed at. ResourceLink must maintain its case for the id of the resource.
Example: For a collection it will look like: “dbs/Reservoirs/colls/contextFeeds”.
What Azure documentation does not explain clearly is when creating a resource the ResourceLink is the parent.
Example: If we want to create a permisison since permisisons belong to a user the
ResourceType = “permissions”
ResourceLink = “dbs/reservoirs/users/<username>”
Example: If we want to create a document since documents belong to a collection:
ResourceType = “docs”
ResourceLink = “dbs/reservoirs/colls/contextFeeds”
Date: The Date portion of the string is the UTC date and time the message was sent (in “HTTP-date” format as defined by RFC 7231 Date/Time Formats)
Example: Tue, 01 Nov 1994 08:12:31 GMT.
*Important:
When using a Master Key Token the date used in the signature must be the same date used in x-ms-date
When using a Resource Token, the Date used to create the signature is the current date,
but the date you specify in the x-ms-date header is the date returned from your REST call when you get the Permission,
which when acted upon will create a new resource token (as explained above in “Resource tokens”).

StringToSign = Verb.toLowerCase() + “\n” + ResourceType.toLowerCase() + “\n” + ResourceLink + “\n” + Date.toLowerCase() + “\n” + “” + “\n”;

The authorization string should be encoded before adding it to the REST request to ensure that it contains no invalid characters. Ensure that it’s Base64 encoded using MIME RFC2045.
*Important: The master key used in the hash signature should be decoded using MIME RFC2045 as it’s Base64 encoded.

x-ms-date

You need to provide the date of the request (current datetime) per RFC 1123 date format expressed in Coordinated Universal Time.
Example, Fri, 08 Apr 2015 03:52:31 GMT
When using a master key this is the same date you specified when you created the signature
When using a resource token this is the timestamp (converted to RFC 1123 format) returned from REST call when you created or fetched the resource.

x-ms-version

This value is currently 2017-02-22, check google for any newer version when you need to.

Now that we know how to create the header keys for a REST API call, we can continue with creating a Resource Token to use in creating documents in Cosmos.

To create a document we must
1) Create a user (one time setup)
2) Create permissions for this user (one time setup)
3) Get the Permission resource so a new resource token is create which is valid for 1 hour by default
4) We can then use this resource token to fetch, update, create, delete documents

As stated above a resource token is created when you grant a user permision so we must first create a user. You can use the SDK to do a one time setup or follow below for steps using the REST API:

Create a User

verb: POST
resourcetype: users
resourcelink: dbs/reservoirs
masterkey: <get the master key from “keys” in the Azure portal for the server you are accessing (example: servername01)
keytype: master
version: 1.0
date: 15 Jan 2018 21:15:43 GMT <<current datetime (C# example: utc_date = DateTime.UtcNow.ToString(“r”))

Using these parameters generate the authorization key using one of the many code examples you can find online:

Using a HTTP tool (like Postman) enter the following parts and execute (you will need to generate your own values):
URL: https://servername01.documents.azure.com:443/dbs/reservoirs/users
Header:
Authorization: type%3dmaster%26ver%3d1.0%26sig%3dqdnr8SgZmqHs7AaQAXW2Y3lK%2f12xkFL690mOD%2b4BYSc%3d
x-ms-date: Mon, 15 Jan 2018 21:15:43 GMT
x-ms-version: 2017-02-22
Body:
{“id”: “nifi_user”}

Create a Permission

    verb: POST
    resourcetype: permissions
    resourcelink: dbs/reservoirs/users/some_user
    masterkey: <get the master key from “keys” in the Azure portal for the server you are accessing (example: servername01)
    keytype: master
    version: 1.0
    date: 15 Jan 2018 21:15:43 GMT <<current datetime

**Generate your authorization token using the code shown above

Using a HTTP tool (like Postman) enter the following parts and execute (you will need to generate your own values):
URL: https://servername01.documents.azure.com:443/dbs/reservoirs/users/nifi_user/permissions
Header:
    Authorization: type%3dmaster%26ver%3d1.0%26sig%3dqdnr8SgZmqHs7AaQAXW2Y3lK%2f12xkFL690mOD%2b4BYSc%3d
    x-ms-date: Mon, 15 Jan 2018 21:15:43 GMT
    x-ms-version: 2017-02-22
Body:
{
“id”: “nifi_user_permission”,
“permissionMode”: “All”,
“resource”: “dbs/reservoirs/colls/contextFeeds”
}

Get Existing Permisison

This will create and return a new resource token to use that is time bound
verb: GET
resourcetype: permissions
resourcelink: dbs/reservoirs/users/nifi_user/permissions/nifi_user_permission
masterkey: <get the master key from “keys” in the Azure portal for the server you are accessing (example: servername01)
keytype: master
version: 1.0
date: 15 Jan 2018 21:15:43 GMT <<current datetime

**Generate your authorization token

Using a HTTP tool (like Postman) enter the following parts and execute (you will need to generate your own values):
URL: https://servername01.documents.azure.com:443/dbs/reservoirs/users/nifi_user/permissions/nifi_user_permission
Header:
    Authorization: type%3dmaster%26ver%3d1.0%26sig%3dqdnr8SgZmqHs7AaQAXW2Y3lK%2f12xkFL690mOD%2b4BYSc%3d
    x-ms-date: Mon, 15 Jan 2018 21:15:43 GMT
    x-ms-version: 2017-02-22
Body:

Response Body:
{
“id”: “nifi_user_permission”,
“permissionMode”: “All”,
“resource”: “dbs/reservoirs/colls/contextFeeds”,
“_rid”: “mxUdAF77CQCTvzGG9CMpAA==”,
“_self”: “dbs/mxUdAA==/users/mxUdAF77CQA=/permissions/mxUdAF77CQCTvzGG9CMpAA==/”,
“_etag”: “\”00000900-0000-0000-0000-5a5d38980000\””,
“_ts”: 1516058776,
“_token”:        “type=resource&ver=1&sig=cvEla+OX1DfXcgiL5Fx9lQ==;Gja/ev6itmGlnhmcVkvxlkFSIFv9+j/1AWe7YIomrNxd3dTho3m1J0brQjp9WmFMnteSgLT1KxTf7+Mmu1vKJFbp9zD7tnv1kKe45EMAs0XmTmkiX2TYcjRVr4u0/Bfd1T77HeBeV8w3nPjfqhv0+6tKDqlZZuo4U NXcvgucq5Ez2ca+K+Ft5rjGdCUA1j3s6zC1/idqqC1z5NAKqNyIxaJC8cCQobCgdulrUyWJccexVE+MChDSkCGuLs5CGwaH;”
}
You want to exact the _ts and _token values in order to create a document.
*Important: the _ts value will need 3 zeros added to the end before you can epoch convert it to a valid datetime.

Create a Document

    verb: POST
Using a HTTP tool (like Postman) enter and execute the following:
URL: https://servername01.documents.azure.com:443/dbs/reservoirs/colls/contextFeeds
Header:
Authorization: <the _token value from step 3>      type=resource&ver=1&sig=cvEla+OX1DfXcgiL5Fx9lQ==;Gja/ev6itmGlnhmcVkvxlkFSIFv9+j/1AWe7YIomrNxd3dTho3m1J0brQjp9WmFMnteSgLT1KxTf7+Mmu1vKJFbp9zD7tnv1kKe45EMAs0XmTmkiX2TYcjRVr4u0/Bfd1T77HeBeV8w3nPjfqhv0+6tKDqlZZuo4UNXcvgucq5Ez2ca+K+Ft5rjGdCUA1j3s6zC1/idqqC1z5NAKqNyIxaJC8cCQobCgdulrUyWJccexVE+MChDSkCGuLs5CGwaH;
x-ms-date: <the _ts: value from step 3 converted to RFC 7231 Date/Time Format
x-ms-version: 2017-02-22
Body: <your valid json document>

Update a Document

    verb: PUT
Using a HTTP tool (like Postman) enter and execute the following:
URL: https://servername01.documents.azure.com:443/dbs/reservoirs/colls/contextFeeds/docs/<document id>
Header:
    Authorization: <the _token value from step 3> type=resource&ver=1&sig=cvEla+OX1DfXcgiL5Fx9lQ==;Gja/ev6itmGlnhmcVkvxlkFSIFv9+j/1AWe7YIomrNxd3dTho3m1J0brQjp9WmFMnteSgLT1KxTf7+Mmu1vKJFbp9zD7tnv1kKe45EMAs0XmTmkiX2TYcjRVr4u0/Bfd1T77HeBeV8w3nPjfqhv0+6tKDqlZZuo4UNXcvgucq5Ez2ca+K+Ft5rjGdCUA1j3s6zC1/idqqC1z5NAKqNyIxaJC8cCQobCgdulrUyWJccexVE+MChDSkCGuLs5CGwaH;
    x-ms-date: <the _ts: value from step 3 converted to RFC 7231 Date/Time Format
    x-ms-version: 2017-02-22
Body:

<your valid json document with the same document Id as specified in the URL>