Authorization and Authentication

These Integration APIs are versioned to provide integrators with the flexibility to leverage future updated APIs based on their integration workflows and development processes. All APIs use OAuth 2.0 as the authorization framework to enable the application to obtain limited access to a user account on an HTTP service.

Once the Default Data application is registered, the service will issue client credentials in the form of a client identifier and a client secret. The Client ID is a publicly exposed string that is used by the service API to identify the application and is also used to build authorization URLs that are presented to users. The Client Secret is used to authenticate the identity of the application to the service API when the application requests to access a user's account and must be kept private between the application and the API.

To use the OAuth 2.0 client credential flow authentication, a Client ID and Client Secret Certificate must be registered per account in Security Administration. To call an API protected with OAuth 2.0 security, you need to present a valid access token. To receive an access token, the client POSTs an API call to the Security Administration Application using the Account’s Client ID and Client Secret Certification (Base64 encoded format) registered values, along with the parameters grant_type=client_credientials and scope=wk-ezcfg-def-data-read.

Refer to the OAuth Client Credential Flow Setup documentation for additional instructions.