def get_api_url(
        self,
        api_resource,
        auth_token_ticket,
        authenticator,
        private_key,
        service_url=None,
        **kwargs
    ):
        '''
        Build an auth-token-protected CAS API url.
        '''
        auth_token, auth_token_signature = self._build_auth_token_data(
            auth_token_ticket,
            authenticator,
            private_key,
            **kwargs
            )
        params = {
            'at': auth_token,
            'ats': auth_token_signature,
            }
        if service_url is not None:
            params['service'] = service_url
        url = '{}?{}'.format(
            self._get_api_url(api_resource),
            urlencode(params),
            )
        return url
Build an auth-token-protected CAS API url.