Mend

Mend Access Management API

The Access Management API from Mend — 5 operation(s) for access management.

GitHub OpenAPI

Operations 5

POST /api/v3.0/login Login #
POST /api/v3.0/login/accessToken Refresh Access Token #
POST /api/v3.0/logout Logout (revokes the refresh token) #
POST /api/v2.0/login/accessToken Refresh Access Token #
POST /api/v2.0/login Login #

Documentation

📖
APIReference
https://api-docs.mend.io/platform/3.0
📖
APIReference
https://api-docs.mend.io/sca/2.0

Specifications

⚙
OpenAPI
https://raw.githubusercontent.com/api-evangelist/mend/refs/heads/main/openapi/mend-access-management-api-openapi.yml

Schemas & Data

📊
JSONSchema
https://raw.githubusercontent.com/api-evangelist/mend/refs/heads/main/json-schema/mend-login-model-dto-schema.json
📊
JSONSchema
https://raw.githubusercontent.com/api-evangelist/mend/refs/heads/main/json-schema/mend-login-model-dtov3-schema.json
📊
JSONSchema
https://raw.githubusercontent.com/api-evangelist/mend/refs/heads/main/json-schema/mend-session-info-schema.json
📊
JSONSchema
https://raw.githubusercontent.com/api-evangelist/mend/refs/heads/main/json-schema/mend-dwrresponse-v3-access-token-response-dto-schema.json
📊
JSONSchema
https://raw.githubusercontent.com/api-evangelist/mend/refs/heads/main/json-schema/mend-dwrresponse-v3-login-response-dto-schema.json
📊
JSONSchema
https://raw.githubusercontent.com/api-evangelist/mend/refs/heads/main/json-schema/mend-dwrresponse-session-info-schema.json

Other Resources

🔗
APIsJSON
https://raw.githubusercontent.com/api-evangelist/mend/refs/heads/main/apis.yml

Work with this as data

Every API here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for apis

7 MCP tools reach this
  • find_apisBrowse and filter every API in the catalog.
  • get_api_artifactsOne API's artifacts, grouped by type.
  • get_openapiThe primary OpenAPI for this API.
  • find_similar_apisAPIs that look like this one.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This API 
curl "https://apis.io/api/v1/apis/mend:mend-access-management-api"
All apis 
curl "https://apis.io/api/v1/apis?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.

OpenAPI Specification

mend-access-management-api-openapi.yml Raw ↑ 
openapi: 3.2.0
info:
  title: Mend Access Management API
  version: '1.0'
  description: 'Operations tagged Access Management across 2 of this provider''s published API definitions: mend-platform-openapi-original.json, mend-sca-openapi-original.json. Each path carries the servers of the definition it was published in.'
servers:
- url: https://baseUrl
  description: Generated server url
- url: https://api-saas.mend.io
  description: Generated server url
security:
- bearer-key: []
tags:
- name: Access Management
paths:
  /api/v3.0/login:
    post:
      tags:
      - Access Management
      summary: Login
      description: 'Sign in a user with email and user key, returning a JWT token which is valid for 30 minutes.

        If you omit the organization, it defaults to the last one you signed in to.'
      operationId: login
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/LoginModelDTOV3'
        required: true
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/DWRResponseV3LoginResponseDTO'
        '400':
          description: Bad Request
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/DWRResponseBase'
        '403':
          description: Forbidden
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/DWRResponseBase'
    servers:
    - url: https://baseUrl
      description: Generated server url
  /api/v3.0/login/accessToken:
    post:
      tags:
      - Access Management
      summary: Refresh Access Token
      description: Generates a new access token from a refresh token
      operationId: refreshAccessToken
      parameters:
      - name: wss-refresh-token
        in: header
        description: Refresh token
        required: true
        schema:
          type: string
      - name: orgUuid
        in: query
        required: false
        schema:
          type: string
        description: 'org UUID (from the Mend App: **Administration** General > **Organization UUID**).'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AccessTokenRequestDTO'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/DWRResponseV3AccessTokenResponseDTO'
        '400':
          description: Bad Request
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/DWRResponseBase'
        '403':
          description: Forbidden
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/DWRResponseBase'
    servers:
    - url: https://baseUrl
      description: Generated server url
  /api/v3.0/logout:
    post:
      tags:
      - Access Management
      summary: Logout (revokes the refresh token)
      operationId: logout
      parameters:
      - name: wss-refresh-token
        in: header
        description: Refresh token
        required: true
        schema:
          type: string
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: string
        '400':
          description: Bad Request
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/DWRResponseBase'
        '403':
          description: Forbidden
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/DWRResponseBase'
    servers:
    - url: https://baseUrl
      description: Generated server url
  /api/v2.0/login/accessToken:
    post:
      tags:
      - Access Management
      summary: Refresh Access Token
      description: Generate a new access token using the provided refresh token.
      operationId: postApiV20LoginAccessToken
      parameters:
      - name: wss-refresh-token
        in: header
        description: Enter the refreshToken received from the login response.
      responses:
        '201':
          description: Created
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SessionInfo'
        '400':
          description: Bad Request
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/DWRResponseBase'
        '403':
          description: Forbidden
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/DWRResponseBase'
      x-operation-id-source: normalized
      x-operation-id-original: refreshAccessToken
    servers:
    - url: https://api-saas.mend.io
      description: Generated server url
  /api/v2.0/login:
    post:
      tags:
      - Access Management
      summary: Login
      description: 'Sign in a user with email and user key, returning a JWT token which is valid for 10 minutes.

        If you omit the organization, it defaults to the last one you signed in to.'
      operationId: postApiV20Login
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/LoginModelDTO'
        required: true
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/DWRResponseSessionInfo'
        '400':
          description: Bad Request
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/DWRResponseBase'
        '403':
          description: Forbidden
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/DWRResponseBase'
      x-operation-id-source: normalized
      x-operation-id-original: login
    servers:
    - url: https://api-saas.mend.io
      description: Generated server url
components:
  schemas:
    DWRResponseBase:
      type: object
      properties:
        supportToken:
          title: Support Token
          type: string
          example: 1171c60d
    LoginResponseDTO:
      type: object
      properties:
        userUuid:
          type: string
        userName:
          type: string
        email:
          type: string
        refreshToken:
          type: string
        jwtTTL:
          type: integer
          format: int64
        systemAccess:
          type: boolean
        serviceSystemAccess:
          type: boolean
        sessionStartTime:
          type: integer
          format: int64
        systemAccessStartTime:
          type: integer
          format: int64
    LoginModelDTOV3:
      required:
      - email
      - userKey
      type: object
      properties:
        email:
          title: Email
          type: string
          example: jon.smith@mail.com
        userKey:
          title: User Key
          type: string
          description: Equivalent to a personal access token. Avoid pasting as plain text where it might be compromised. For a service user (recommended), you can find the user key in the Mend SCA App in **Admin > Users**. [Learn more](https://docs.mend.io/bundle/mend_maintenance/page/managing_service_users.html). For local testing purposes, you could also use one of your own personal user keys from your user profile page in the Mend SCA App.
          example: '***********'
      description: Login Model that provides user name and password for the Login process.
    AccessTokenRequestDTO:
      type: object
      properties:
        accessToken:
          type: string
      description: Previous Access Token
    DWRResponseV3AccessTokenResponseDTO:
      type: object
      properties:
        supportToken:
          title: Support Token
          type: string
          example: 1171c60d
        response:
          $ref: '#/components/schemas/AccessTokenResponseDTO'
    AccessTokenResponseDTO:
      type: object
      properties:
        userUuid:
          type: string
        username:
          type: string
        email:
          type: string
        jwtToken:
          type: string
        tokenType:
          type: string
        orgName:
          type: string
        orgUuid:
          type: string
        accountName:
          type: string
        accountUuid:
          type: string
        tokenTTL:
          type: integer
          format: int64
        systemAccess:
          type: boolean
        serviceSystemAccess:
          type: boolean
        sessionStartTime:
          type: integer
          format: int64
        systemAccessStartTime:
          type: integer
          format: int64
    DWRResponseV3LoginResponseDTO:
      type: object
      properties:
        supportToken:
          title: Support Token
          type: string
          example: 1171c60d
        response:
          $ref: '#/components/schemas/LoginResponseDTO'
    DWRResponseSessionInfo:
      type: object
      properties:
        supportToken:
          title: Support Token
          type: string
          example: 1171c60d
        retVal:
          $ref: '#/components/schemas/SessionInfo'
    LoginModelDTO:
      required:
      - email
      - userKey
      type: object
      properties:
        email:
          title: Email
          type: string
          example: jon.smith@mail.com
        orgToken:
          title: Org Token
          type: string
          description: 'org UUID (by running Entities - Organization > Get User Organizations) or API Key (from the Mend SCA App: Integrate tab > API Key).'
          example: 123e4567-e89b-12d3-a456-426655440000
        userKey:
          title: User Key
          type: string
          description: Equivalent to a personal access token. Avoid pasting as plain text where it might be compromised. For a service user (recommended), you can find the user key in the Mend SCA App in **Admin > Users**. [Learn more](https://docs.mend.io/bundle/mend_maintenance/page/managing_service_users.html). For local testing purposes, you could also use one of your own personal user keys from your user profile page in the Mend SCA App.
          example: '***********'
      description: Login Model that provides user name and password for the Login process.
    SessionInfo:
      type: object
      properties:
        correlationId:
          type: string
        userUuid:
          type: string
        userName:
          type: string
        email:
          type: string
        refreshToken:
          type: string
        jwtToken:
          type: string
        orgName:
          title: Organization Name
          type: string
          example: Organization A
        orgUuid:
          title: Organization Uuid
          type: string
          example: 123e4567-e89b-12d3-a456-426655440000
  securitySchemes:
    bearer-key:
      type: http
      description: JWT token Bearer
      scheme: bearer
      bearerFormat: JWT
x-refined-from:
- mend-platform-openapi-original.json
- mend-sca-openapi-original.json