How to create a signature for the Ascentis API using PHP - php

Question

I am trying to create the proper signature for the Ascentis API. There documentation is http://www.ascentis.com/API/Ascentis_API_Documentation.pdf. Page 4 describes the Signature format.
Here is my PHP code. Am I doing something wrong? I get a "not authorized error".
$url='https://selfservice2.ascentis.com/mycompany/api/v1.1/employees';
$timestamp=gmdate('Y-m-d\TH:i:s\Z');
$path=strtolower(str_replace('https://selfservice2.ascentis.com','',$url));
$signature_string="GET {$path} {$timestamp}";
$signature=hash_hmac("sha1",$signature_string,$secret_key);
$authorization=encodeUrl($client_key).':'.encodeUrl($signature);

Answer 1

Here's a more complete example. Props to #Steve Lloyd for getting me in the right direction.
$codes['secret_key'] = 'my_secret';
$client_key = 'my_key';
$url = 'https://selfservice.ascentis.com/my_company/api/v1.1/employees?lastname=%s';
$timestamp = gmdate('Y-m-d\TH:i:s\Z');
$path = strtolower(str_replace('https://selfservice.ascentis.com', '', $url));
$signature_string = "GET {$path} {$timestamp}";
$signature = base64_encode(hash_hmac("sha1", $signature_string, $codes['secret_key'], TRUE));
$authorization = urlencode($client_key) . ':' . urlencode($signature);
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($ch, CURLOPT_CONNECTTIMEOUT, 5);
curl_setopt($ch, CURLOPT_TIMEOUT, 5);
curl_setopt($ch, CURLOPT_HTTPHEADER, [
"Authorization: " . $authorization,
"Accept: application/xml",
"Timestamp: " . $timestamp,
]);
curl_setopt($ch, CURLINFO_HEADER_OUT, true);
$data = curl_exec($ch);
$info = curl_getinfo($ch);
$httpcode = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
echo "Received $httpcode from $url\n";
echo "Key: $client_key\n";
echo "Signature: $signature\n";
echo "authorization: $authorization\n";
echo "request info:" . var_export($info, TRUE) . "\n";
echo "data:\n";
var_export($data, TRUE)

Answer 2

After playing the trial and error game I was able to get this working. It turns out that you have to set hash_hmac to raw_output. Here is the working code:
$url='https://selfservice2.ascentis.com/mycompany/api/v1.1/employees';
$timestamp=gmdate('Y-m-d\TH:i:s\Z');
$path=strtolower(str_replace('https://selfservice2.ascentis.com','',$url));
$signature_string="GET {$path} {$timestamp}";
$signature=base64_encode(hash_hmac("sha1",$signature_string,$codes['secret_key'],true));
$authorization=encodeUrl($client_key).':'.encodeUrl($signature);