OneTrust System Credentials API

openapi: 3.2.0
info:
  title: Platform - Integrations System Credentials API
  version: '1.0'
  contact:
    name: OneTrust Support
    url: https://my.onetrust.com/s/contactsupport
  license:
    name: Apache 2.0
    url: https://www.apache.org/licenses/LICENSE-2.0
  description: The Integrations APIs are used to configure, manage, and automate integrations. They provide functionality to handle system credentials, import and export workflows, and manage integration details.
servers:
- url: https://{hostname}/api/integrationmanager
  variables:
    hostname:
      default: hostname
      description: The OneTrust hostname such as app.onetrust.com, app-eu.onetrust.com, app-de.onetrust.com, app-uk.onetrust.com, app-apac.onetrust.com, trial.onetrust.com, or uat.onetrust.com.
tags:
- name: System Credentials
  description: APIs used to create and update system credentials required for integrations, such as authentication keys and connection details.
  externalDocs:
    description: OpenAPI 3.1.0 - Download Definition
    url: https://developer.onetrust.com/onetrust/openapi/platform-integrations.json
paths:
  /v2/credentials/{type}:
    put:
      operationId: updateV2UsingPUT
      summary: Update System Credential
      description: Use this API to update details for an existing credential.
      tags:
      - System Credentials
      x-onetrust:
        spec-label: https://developer.onetrust.com/onetrust/openapi/platform-integrations.json
      parameters:
      - name: type
        in: path
        description: Specify the connector type.
        required: true
        schema:
          type: string
          enum:
          - HTTP
        example: HTTP
      - name: name
        in: query
        description: Name of the credential to update.
        required: true
        schema:
          type: string
        example: my-credential
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CredentialsV2Dto'
      responses:
        '202':
          description: Accepted
        '400':
          description: Bad Request
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '429':
          description: "Too Many Requests. \nFor more information, see [API Rate Limits](https://developer.onetrust.com/onetrust/reference/rate-limits-overview)."
          headers:
            Retry-After:
              schema:
                description: The number of seconds after which requests will be allowed again.
                format: int32
            ot-period:
              schema:
                description: The unit of time for which the rate limit applies
                enum:
                - HOUR
                - MINUTE
            ot-ratelimit-event-id:
              schema:
                description: The unique identifier for the rate-limiting event.
                format: uuid
            ot-request-made:
              schema:
                description: The number of requests made within the specified period.
                format: int32
            ot-requests-allowed:
              schema:
                description: The number of requests allowed within the specified period.
                format: int32
        '500':
          description: Internal Server Error
      security:
      - OAUTH2:
        - INTEGRATIONS
    post:
      operationId: createV2UsingPOST
      summary: Create System Credential
      description: Use this API to create a new credential for a specific connector type.
      tags:
      - System Credentials
      x-onetrust:
        spec-label: https://developer.onetrust.com/onetrust/openapi/platform-integrations.json
      parameters:
      - name: type
        in: path
        description: Specify the connector type.
        required: true
        schema:
          type: string
          enum:
          - HTTP
        example: HTTP
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CredentialsV2Dto'
      responses:
        '201':
          description: Created
        '400':
          description: Bad Request
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '429':
          description: "Too Many Requests. \nFor more information, see [API Rate Limits](https://developer.onetrust.com/onetrust/reference/rate-limits-overview)."
          headers:
            Retry-After:
              schema:
                description: The number of seconds after which requests will be allowed again.
                format: int32
            ot-period:
              schema:
                description: The unit of time for which the rate limit applies
                enum:
                - HOUR
                - MINUTE
            ot-ratelimit-event-id:
              schema:
                description: The unique identifier for the rate-limiting event.
                format: uuid
            ot-request-made:
              schema:
                description: The number of requests made within the specified period.
                format: int32
            ot-requests-allowed:
              schema:
                description: The number of requests allowed within the specified period.
                format: int32
        '500':
          description: Internal Server Error
      security:
      - OAUTH2:
        - INTEGRATIONS
components:
  schemas:
    BasicAuth:
      allOf:
      - $ref: '#/components/schemas/AuthContext'
      - type: object
        properties:
          userName:
            description: Username of the Basic Type Credential
            type: string
            example: Credential_Username
          password:
            description: Password of the Basic Type Credential
            type: string
            format: password
            example: Credential_Password
      required:
      - password
      - userName
    AuthParams:
      type: object
      properties:
        params:
          description: Object containing params settings.
          type: object
          additionalProperties:
            type: string
        present:
          description: Indicates whether present is enabled.
          type: boolean
    ApiKeyAuth:
      allOf:
      - $ref: '#/components/schemas/AuthContext'
      - type: object
        properties:
          key:
            description: Key of the ApiKey Type Credential
            type: string
            example: X-API-Key
          value:
            description: Value of the ApiKey
            type: string
            format: password
            example: Credential_Value
          authParameterType:
            description: Authentication parameter type for the API key
            type: string
            example: SEND_IN_HEADERS
            enum:
            - SEND_IN_BODY
            - SEND_IN_REQUESTPARAMS
            - SEND_IN_URL_ENCODED
            - SEND_IN_HEADERS
      required:
      - authParameterType
      - key
      - value
    CredentialsV2Dto:
      type: object
      properties:
        name:
          description: Unique name that identifies this credential.
          type: string
          example: my-prod-credentials
        authType:
          description: Authentication type represented by this credential.
          type: string
          example: OAUTH2_TOKEN
          enum:
          - BASIC
          - API_KEY
          - BEARER_TOKEN
          - OAUTH2_TOKEN
          - CUSTOM
        authContext:
          description: Authentication context with type‚Äëspecific configuration; structure varies by authentication type.
          oneOf:
          - $ref: '#/components/schemas/BasicAuth'
          - $ref: '#/components/schemas/ApiKeyAuth'
          - $ref: '#/components/schemas/BearerTokenAuth'
          - $ref: '#/components/schemas/OAuth2TokenAuth'
          - $ref: '#/components/schemas/CustomAuth'
        description:
          description: Human‚Äëreadable purpose for this credential.
          type: string
          example: Used for authenticating with the production environment
        integrationName:
          description: Name of the integration associated with this credential.
          type: string
          example: systemName
      required:
      - authContext
      - authType
      - integrationName
      - name
    CustomAuth:
      allOf:
      - $ref: '#/components/schemas/AuthContext'
    BearerTokenAuth:
      allOf:
      - $ref: '#/components/schemas/AuthContext'
      - type: object
        properties:
          token:
            description: Bearer token value
            type: string
            format: password
            example: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...
    AuthContext:
      type: object
      properties:
        headers:
          description: HTTP headers to include for this credential.
          type: object
          example:
            Content-Type: application/x-www-form-urlencoded
          additionalProperties:
            type: string
        type:
          description: Authentication type.
          type: string
          example: BASIC
          enum:
          - NO_AUTH
          - BASIC
          - BEARER_TOKEN
          - OAUTH2_TOKEN
          - DIGEST
          - NTLM
          - API_KEY
          - FTP_PASSWORD
          - SFTP
          - FTPS
          - DB_SQLSERVER
          - HMAC
          - PGP
          - REFERENCE_AUTH
          - AWS
          - CUSTOM
          - AZURE
          - JWE
          - OAUTH2_OIDC
        hostName:
          description: Host name of the target system.
          type: string
          example: example.com
        testUrl:
          description: URL used to test this credential.
          type: string
          example: https://example.com/sample/test
        connectorType:
          description: Connector category (e.g., HTTP, FTP, DATABASE).
          type: string
          example: HTTP
          enum:
          - HTTP
          - FTP
          - DATABASE
          - ENCRYPTION
          - DECRYPTION
          - REFERENCE
          - CLOUD_SDK
          - SIMPLE_CONNECT
        mtlsEnabled:
          description: Enable mutual TLS for this credential.
          type: boolean
          example: true
          default: 'false'
        clientCertificate:
          description: Client certificate (PEM) used for mutual TLS authentication.
          type: string
          format: password
          example: '-----BEGIN CERTIFICATE-----

            MIIDazCCAlOgAwIBAgIUJlq+zz4...

            -----END CERTIFICATE-----'
        privateKey:
          description: Private key (PEM) used for mutual TLS authentication.
          type: string
          format: password
          example: REDACTED_PRIVATE_KEY_EXAMPLE
        privateKeyPassword:
          description: Password for the encrypted private key, if applicable.
          type: string
          format: password
          example: keypassword
        serverRootCACertificate:
          description: Server Root CA certificate (PEM) for TLS server verification.
          type: string
          format: password
          example: '-----BEGIN CERTIFICATE-----

            MIIDazCCAlOgAwIBAgIUJlq+zz4...

            -----END CERTIFICATE-----'
        cacheKey:
          description: Value for cache key.
          type: string
        sendCredential:
          description: Value for send credential.
          type: string
          enum:
          - HTTP_HEADERS
          - XML_ENVELOPE
        authParams:
          description: Value for auth params.
          $ref: '#/components/schemas/AuthParams'
      discriminator:
        propertyName: type
        mapping:
          BASIC: '#/components/schemas/BasicAuth'
          API_KEY: '#/components/schemas/ApiKeyAuth'
          BEARER_TOKEN: '#/components/schemas/BearerTokenAuth'
          OAUTH2_TOKEN: '#/components/schemas/OAuth2TokenAuth'
          CUSTOM: '#/components/schemas/CustomAuth'
    OAuth2TokenAuth:
      allOf:
      - $ref: '#/components/schemas/AuthContext'
      - type: object
        properties:
          grantType:
            description: OAuth 2.0 grant type
            type: string
            example: client_credentials
          authUrl:
            description: Authorization URL for OAuth 2.0 flow
            type: string
            format: uri
            example: https://auth.example.com/authorize
          tokenUrl:
            description: Token URL for obtaining access tokens
            type: string
            format: uri
            example: https://auth.example.com/token
          clientId:
            description: OAuth 2.0 client identifier
            type: string
            example: client-id-123456
          clientSecret:
            description: OAuth 2.0 client secret
            type: string
            format: password
            example: client-secret-abcdef
          state:
            description: State parameter for CSRF protection
            type: string
            example: random-state-string
          username:
            description: Username for password grant type
            type: string
            example: user@example.com
          password:
            description: Password for password grant type
            type: string
            format: password
            example: user-password
          accessToken:
            description: OAuth 2.0 access token
            type: string
            format: password
            example: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...
          bearerType:
            description: Bearer token type
            type: string
            example: Bearer
          expiresIn:
            description: Token expiration time in seconds
            type: string
            example: 3600
          oauth2Type:
            description: OAuth 2.0 implementation type
            type: string
            example: standard
          refreshToken:
            description: OAuth 2.0 refresh token
            type: string
            format: password
            example: refresh-token-xyz123
          scope:
            description: OAuth 2.0 scope
            type: string
            example: read write
          tokenType:
            description: Token type
            type: string
            example: Bearer
          authParameterType:
            description: Authentication parameter type
            type: string
            example: SEND_IN_HEADERS
            enum:
            - SEND_IN_BODY
            - SEND_IN_REQUESTPARAMS
            - SEND_IN_URL_ENCODED
            - SEND_IN_HEADERS
          tokenSecret:
            description: Token secret for OAuth 1.0 signature flow
            type: string
            example: token-secret-123456
          consumerKey:
            description: Consumer key for OAuth 1.0 signature flow
            type: string
            example: consumer-key-123456
          consumerSecret:
            description: Consumer secret for OAuth 1.0 signature flow
            type: string
            format: password
            example: consumer-secret-abcdef
          signatureMethod:
            description: Signature method for OAuth 1.0 signature flow
            type: string
            example: HMAC-SHA1
            enum:
            - HMAC_SHA1
            - HMAC_SHA256
          timestamp:
            description: Timestamp for OAuth 1.0 signature flow
            type: string
            example: 1643723900
          nonce:
            description: Nonce for OAuth 1.0 signature flow
            type: string
            example: random-nonce-string
          version:
            description: Version for OAuth 1.0 signature flow
            type: string
            example: 1
          realm:
            description: Realm for OAuth 1.0 signature flow
            type: string
            example: example.com
          claims:
            description: Claims for OAuth 1.0 JWT flow
            type: string
            example:
              iss: example.com
              aud: https://example.com
          signatureAlgorithm:
            description: Signature algorithm for OAuth 1.0 JWT flow
            type: string
            example: RS256
            enum:
            - NONE
            - HS256
            - HS384
            - HS512
            - RS256
            - RS384
            - RS512
            - ES256
            - ES384
            - ES512
            - PS256
            - PS384
            - PS512
          subject:
            description: Subject for OAuth 1.0 JWT flow
            type: string
            example: user@example.com
          audience:
            description: Audience for OAuth 1.0 JWT flow
            type: string
            example: https://example.com
          certificate:
            description: Certificate for OAuth 1.0 JWT flow
            type: string
            format: password
            example: '-----BEGIN CERTIFICATE-----

              ...

              -----END CERTIFICATE-----'
          additionalHeaders:
            description: Additional headers for OAuth 1.0 JWT flow
            type: string
            example:
              header: value
          expirationTime:
            description: Expiration time for OAuth 1.0 JWT flow
            type: integer
            format: int64
            example: 1643723900
          issuer:
            description: Issuer for OAuth 1.0 JWT flow
            type: string
            example: example.com
          iatRequired:
            description: Whether iat is required for OAuth 1.0 JWT flow
            type: boolean
            example: true
          nbfRequired:
            description: Whether nbf is required for OAuth 1.0 JWT flow
            type: boolean
            example: true
          jtiRequired:
            description: Whether jti is required for OAuth 1.0 JWT flow
            type: boolean
            example: true
          customAssertion:
            description: Custom assertion for OAuth 1.0 JWT flow
            type: string
            example:
              key: value
          additionalAuthParams:
            description: Additional authentication parameters
            type: object
            example:
              key: value
            additionalProperties:
              type: string
          additionalParams:
            description: Additional parameters
            type: object
            example:
              key: value
            additionalProperties:
              type: object
          popTokenRequired:
            description: Whether PoP token is required
            type: boolean
            example: true
          certificateName:
            description: Certificate name for PoP token
            type: string
            example: example-cert
          accessTokenPath:
            description: Access token path for custom OAuth 2.0 authentication
            type: string
            example: /oauth2/token
          customAuthHeader:
            description: Custom authentication headers
            type: object
            example:
              header: value
            additionalProperties:
              type: string
          refreshTokenGrant:
            type: boolean
          clientCredentialsGrant:
            type: boolean
          passwordCredentialsGrant:
            type: boolean
          authorizationCodeGrant:
            type: boolean
          signedClientCredentialsGrant:
            type: boolean
          jwtclientCredentialsGrant:
            type: boolean
          validGrantType:
            type: boolean
      required:
      - authParameterType
      - clientId
      - clientSecret
      - grantType
      - tokenUrl
  securitySchemes:
    OAUTH2:
      type: oauth2
      flows:
        clientCredentials:
          tokenUrl: https://{hostname}/api/access/v1/oauth/token
          scopes:
            INTEGRATIONS: Integration scope for external systems
x-onetrust:
  spec-label: OpenAPI 3.1.0
  links:
  - '{''Integrations Knowledge Base'': ''https://my.onetrust.com/s/topic/0TO1Q000000ItT9WAK/integrations''}'
x-readme:
  explorer-enabled: false
  proxy-enabled: false
  metrics-enabled: false