Authentication

All Administration Self-Managed API requests require authentication. To authenticate, generate a JSON Web Token (JWT) and include it in each request.

Generate a token

1. Add an M2M application in Management Identity.
2. Add permissions to this application for Console API.
3. Capture the Client ID and Client Secret from the application in Management Identity.
4. Generate a token to access the Administration REST API. Provide the client_id and client_secret from the values you previously captured in Management Identity.

   curl --location --request POST 'http://localhost:18080/auth/realms/camunda-platform/protocol/openid-connect/token' \
   --header 'Content-Type: application/x-www-form-urlencoded' \
   --data-urlencode "client_id=${CLIENT_ID}" \
   --data-urlencode "client_secret=${CLIENT_SECRET}" \
   --data-urlencode 'grant_type=client_credentials'

   A successful authentication response looks like the following:

   {
     "access_token": "<TOKEN>",
     "expires_in": 300,
     "refresh_expires_in": 0,
     "token_type": "Bearer",
     "not-before-policy": 0
   }

5. Capture the value of the access_token property and store it as your token.

Use a token

Include the previously captured token as an authorization header in each request: Authorization: Bearer <TOKEN>.

For example, to send a request to the "Get current clusters" endpoint:

tip

The ${CAMUNDA_BASE_URL} variable below represents the URL of the Self-Managed environment. You can configure this value in your Self-Managed installation. The default value is http://localhost:8080.

curl --request GET ${CAMUNDA_BASE_URL}/admin-api/clusters \
   --header "Authorization: Bearer ${TOKEN}"

A successful response includes cluster information. For example:

[
  {
    "uuid": "12345",
    "name": "cluster-1",
    "status": "healthy",
    ...
  }
]

Token expiration

Access tokens expire according to the expires_in property of a successful authentication response. After this duration, in seconds, you must request a new access token.