Authentication

All Administration Self-Managed API requests require authentication. To authenticate, generate a JSON Web Token (JWT) and include it in each request.

Generating a token

1. Add an M2M application in Identity.
2. Add permissions to this application for Administration Self-Managed API.
3. Capture the Client ID and Client Secret from the application in Identity.
4. Generate a token to access the REST API. Provide the client_id and client_secret from the values you previously captured in Identity.

   curl --location --request POST 'http://localhost:18080/auth/realms/camunda-platform/protocol/openid-connect/token' \
   --header 'Content-Type: application/x-www-form-urlencoded' \
   --data-urlencode "client_id=${CLIENT_ID}" \
   --data-urlencode "client_secret=${CLIENT_SECRET}" \
   --data-urlencode 'grant_type=client_credentials'
5. A successful authentication response looks like the following:

   {
     "access_token": "<TOKEN>",
     "expires_in": 300,
     "refresh_expires_in": 0,
     "token_type": "Bearer",
     "not-before-policy": 0
   }
6. Capture the value of the access_token property and store it as your token.

Using a token

Include the previously captured token as an authorization header in each request: Authorization: Bearer <TOKEN>.

For example, to send a request to the "Get current clusters" endpoint:

tip

The ${CAMUNDA_BASE_URL} variable below represents the URL of the Self-Managed environment. You can configure this value in your Self-Managed installation. The default value is http://localhost:8080.

curl --request GET ${CAMUNDA_BASE_URL}/admin-api/clusters \
   --header "Authorization: Bearer ${TOKEN}"

A successful response includes cluster information. For example:

[
  {
    "uuid": "12345",
    "name": "cluster-1",
    "status": "healthy",
    ...
  }
]

Token expiration

Access tokens expire according to the expires_in property of a successful authentication response. After this duration, in seconds, you must request a new access token.