The Auth REST SDK manages authorization bearer tokens. The tokens you need are based on the set of API calls that your client uses. The Auth SDK uses the VEDauth service to grant access and manage tokens. No installation is necessary. However, configuration is required. For more information, see Setting up token authentication.
Every API here is available over the APIs.io API and to AI agents over MCP.
One button, every client — Claude, Cursor, VS Code and the rest.
https://apis.io/mcp
find_apisBrowse and filter every API in the catalog.get_api_artifactsOne API's artifacts, grouped by type.get_openapiThe primary OpenAPI for this API.find_similar_apisAPIs that look like this one.apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.resolveTurn a domain, URL or GitHub org into the provider it belongs to.find_cohortsEvery scored population of providers in the catalog.curl "https://apis.io/api/v1/apis/venafi-authentication-server-apis-api"curl "https://apis.io/api/v1/apis?limit=25"Discovery needs no key. Ratings and market analysis are Pro.
Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.
A second provider on the same verified email joins the account you already have.
openapi: 3.2.0
info:
title: Trust Protection Foundation WebSDK Authentication Server…
description: '# Introduction
The Trust Protection Foundation Web SDK is a subset of REST APIs that allow you to:
* Automate certificate management
* Integrate with DevOps processes
* Discover machine identities
* Extract data to integrate with data warehouses
* Perform bulk actions
* Set up and administer Trust Protection Foundation
* Onboard teams
* Create custom, automated business logic and flows between internal systems
All these use cases can be accomplished using the Trust Protection Foundation REST…'
version: 26.1.1
servers:
- url: /
description: Current Host
- url: https://REPLACEdnsnameME/
description: System
- url: https://{dnsname}/
description: Configurable Hostname
variables:
dnsname:
default: localhost
description: Production API Hostname
security:
- AccessToken: []
tags:
- name: Authentication Server APIs
description: 'The Auth REST SDK manages authorization bearer tokens. The tokens you need are based on the set of API calls that your client uses.
The Auth SDK uses the VEDauth service to grant access and manage tokens. No installation is necessary.
However, configuration is required. For more information, see Setting up token authentication.'
paths:
/vedauth/authorize/device:
post:
tags:
- Authentication Server APIs
summary: Request a device grant
description: 'Triggers a grant request via device authorization flow (See RFC 8628 Section 3.1)
_Required scope: Any_'
operationId: Venafi_Web_SDK_Authentication_Authorize_RequestDeviceAuth
requestBody:
content:
application/x-www-form-urlencoded:
schema:
$ref: '#/components/schemas/Web_SDK_Authentication_AuthorizeOAuthRequest_device'
required: true
responses:
'200':
description: Grant issued
content:
application/json:
schema:
$ref: '#/components/schemas/Web_SDK_Authentication_AuthorizeOAuthResponse_device'
'400':
description: Grant issuance denied
content:
application/json:
schema:
$ref: '#/components/schemas/Web_SDK_Authentication_AuthError'
/vedauth/authorize/oauth:
post:
tags:
- Authentication Server APIs
summary: Request a grant with user credentials
description: '_Required scope: Any_'
operationId: Venafi_Web_SDK_Authentication_Authorize_AuthorizeOAuth
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/Web_SDK_Authentication_AuthorizeOAuthRequest_oauth'
required: true
responses:
'200':
description: Grant issued
content:
application/json:
schema:
$ref: '#/components/schemas/Web_SDK_Authentication_AuthorizeOAuthResponse_oauth'
'400':
description: Grant issuance denied
content:
application/json:
schema:
$ref: '#/components/schemas/Web_SDK_Authentication_AuthError'
/vedauth/authorize/integrated:
post:
tags:
- Authentication Server APIs
summary: Request a grant via NTLM/Kerberos
description: '_Required scope: Any_'
operationId: Venafi_Web_SDK_Authentication_Authorize_IntegratedAuthorize
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/Web_SDK_Authentication_AuthorizeOAuthRequest_integrated'
required: true
responses:
'200':
description: Grant issued
content:
application/json:
schema:
$ref: '#/components/schemas/Web_SDK_Authentication_AuthorizeOAuthResponse_integrated'
'400':
description: Grant issuance denied
content:
application/json:
schema:
$ref: '#/components/schemas/Web_SDK_Authentication_AuthError'
/vedauth/authorize/certificate:
post:
tags:
- Authentication Server APIs
summary: Request a grant via certificate
description: '_Required scope: Any_'
operationId: Venafi_Web_SDK_Authentication_Authorize_CertificateAuthorize
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/Web_SDK_Authentication_AuthorizeOAuthRequest_certificate'
required: true
responses:
'200':
description: Grant issued
content:
application/json:
schema:
$ref: '#/components/schemas/Web_SDK_Authentication_AuthorizeOAuthResponse_certificate'
'400':
description: Grant issuance denied
content:
application/json:
schema:
$ref: '#/components/schemas/Web_SDK_Authentication_AuthError'
/vedauth/authorize/jwt:
post:
tags:
- Authentication Server APIs
summary: Request a grant via JWT
description: '_Required scope: Any_'
operationId: Venafi_Web_SDK_Authentication_Authorize_JwtAuthorize
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/Web_SDK_Authentication_AuthorizeOAuthRequest_jwt'
required: true
responses:
'200':
description: Grant issued
content:
application/json:
schema:
$ref: '#/components/schemas/Web_SDK_Authentication_AuthorizeOAuthResponse_jwt'
'400':
description: Grant issuance denied
content:
application/json:
schema:
$ref: '#/components/schemas/Web_SDK_Authentication_AuthError'
/vedauth/authorize/token:
post:
tags:
- Authentication Server APIs
summary: Refresh a bearer/device token
description: 'This endpoint supports refreshing bearer tokens as well as device access tokens (OAuth 2.0 Device Authorization Grant).
_Required scope: Any_'
operationId: Venafi_Web_SDK_Authentication_Authorize_Token
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/Web_SDK_Authentication_TokenOAuthRequest'
required: true
responses:
'200':
description: Success
content:
application/json:
schema:
$ref: '#/components/schemas/Web_SDK_Authentication_AuthorizeOAuthResponse'
'403':
description: ' The API requires a scope not granted to the provided access token '
content:
application/json:
schema:
$ref: '#/components/schemas/Web_SDK_Authentication_OAuthError'
'400':
description: ' Missing or invalid request property. '
content:
application/json:
schema:
$ref: '#/components/schemas/Web_SDK_Authentication_OAuthError'
'401':
description: ' A valid access token is required. '
content:
application/json:
schema:
$ref: '#/components/schemas/Web_SDK_Authentication_OAuthError'
security:
- AccessToken: []
/vedauth/authorize/verify:
get:
tags:
- Authentication Server APIs
summary: Verify bearer token validity
description: '_Required scope: Any_'
operationId: Venafi_Web_SDK_Authentication_Authorize_VerifyToken
responses:
'200':
description: Success
content:
application/json:
schema:
$ref: '#/components/schemas/Web_SDK_Authentication_AuthorizeVerifyResponse'
'403':
description: ' The API requires a scope not granted to the provided access token '
content:
application/json:
schema:
$ref: '#/components/schemas/Web_SDK_Authentication_OAuthError'
'400':
description: ' Missing or invalid request property. '
content:
application/json:
schema:
$ref: '#/components/schemas/Web_SDK_Authentication_OAuthError'
'401':
description: ' A valid access token is required. '
content:
application/json:
schema:
$ref: '#/components/schemas/Web_SDK_Authentication_OAuthError'
security:
- AccessToken: []
/vedauth/authorize/IsAuthServer:
get:
tags:
- Authentication Server APIs
summary: Verify server availability
description: 'This endpoint can be used by a client to ensure the auth server is running before attempting to perform grant tasks
_Required scope: Any_'
operationId: Venafi_Web_SDK_Authentication_Authorize_IsAuthServer
responses:
'200':
description: Server available
security:
- AccessToken: []
/vedauth/revoke/token:
get:
tags:
- Authentication Server APIs
summary: Revoke grant
description: 'Revokes the grant passed in via a bearer token in the header
_Required scope: Any_'
operationId: Venafi_Web_SDK_Authentication_Revoke_RevokeGrant
responses:
'200':
description: Grant revoked
'202':
description: Grant revocation failed
security:
- AccessToken: []
components:
schemas:
Web_SDK_Authentication_AuthorizeOAuthResponse_jwt:
type: object
properties:
access_token:
type: string
description: The scope (WebSDK, CSP, etc) this grant applies to
refresh_token:
type: string
description: The token to use to get an updated access token
scope:
type: string
description: The scope of the grant
identity:
type: string
description: The identity the grant is for
Web_SDK_Authentication_AuthorizeOAuthRequest_oauth:
type: object
properties:
client_id:
type: string
description: Client (Application) ID
username:
type: string
description: Valid username; can be prefixed with provider
password:
type: string
description: Valid password for _Username_
scope:
type: string
description: Desired Scope
Web_SDK_Authentication_AuthorizeVerifyResponse:
type: object
properties:
identity:
type: string
description: The PrefixedUniversal identity the grant has been issued to
scope:
type: string
description: The scope (WebSDK, CSP, etc) this grant applies to
valid_for:
type: integer
description: Number of seconds the access token is valid
format: int64
access_issued_on:
type: string
description: The date and time (UTC) when the access token was issued last
access_issued_on_unix_time:
type: integer
description: Unixtime when the access token was issued last
format: int64
access_issued_on_ISO8601:
type: string
description: The date and time (UTC) when the access token was issued last, in ISO-8601 format
expires:
type:
- string
- 'null'
description: The date and time (UTC) when the grant expires and cannot be refreshed, null if it does not expire
expires_unix_time:
type: integer
description: Unixtime when the grant expires and cannot be refreshed anymore, 0 if it does not expire
format: int64
expires_ISO8601:
type: string
description: The date and time (UTC) when the grant expires and cannot be refreshed, null if it does not expire (in ISO-8601 format)
grant_issued_on:
type: string
description: The date and time (UTC) when the grant was issued
grant_issued_on_unix_time:
type: integer
description: Unixtime when the grant was issued
format: int64
grant_issued_on_ISO8601:
type: string
description: The date and time (UTC) when the grant was issued (in ISO-8601 format)
application:
type: string
description: The application this grant applies to
description: Holds information about a particular access grant
Web_SDK_Authentication_AuthorizeOAuthRequest_certificate:
type: object
properties:
client_id:
type: string
description: Client (Application) ID
scope:
type: string
description: Desired Scope
Web_SDK_Authentication_TokenOAuthRequest:
type: object
properties:
refresh_token:
type: string
description: Gets or sets the refresh token being used to obtain a new access token.
client_id:
type: string
description: Gets or sets the client id.
grant_type:
type: string
description: OAuth grant type.
device_code:
type: string
description: The device verification code, "device_code" from the device authorization response.
description: RFC6749 token request.
Web_SDK_Authentication_AuthError:
type: object
properties:
error:
type: string
description: One of the errors defined in RFC 6749 Section 5.2
error_description:
type: string
description: Detailed error explanation
description: Class to generate OAuth Authentication Server error responses (See RFC6749, Section 5.2)
Web_SDK_Authentication_AuthorizeOAuthResponse_certificate:
type: object
properties:
access_token:
type: string
description: The scope (WebSDK, CSP, etc) this grant applies to
refresh_token:
type: string
description: The token to use to get an updated access token
scope:
type: string
description: The scope of the grant
identity:
type: string
description: The identity the grant is for
Web_SDK_Authentication_AuthorizeOAuthRequest_integrated:
type: object
properties:
client_id:
type: string
description: Client (Application) ID
scope:
type: string
description: Desired Scope
Web_SDK_Authentication_AuthorizeOAuthRequest_device:
type: object
properties:
client_id:
type: string
description: Client (Application) ID
scope:
type: string
description: Desired Scope
Web_SDK_Authentication_OAuthError:
type: object
properties:
error:
type: string
description: Gets or sets the short error name
error_description:
type: string
description: Gets or sets the description of the error
description: REST OAuth Error Response
Web_SDK_Authentication_AuthorizeOAuthResponse_device:
type: object
properties:
access_token:
type: string
description: The scope (WebSDK, CSP, etc) this grant applies to
refresh_token:
type: string
description: The token to use to get an updated access token
scope:
type: string
description: The scope of the grant
identity:
type: string
description: The identity the grant is for
Web_SDK_Authentication_AuthorizeOAuthResponse_oauth:
type: object
properties:
access_token:
type: string
description: The scope (WebSDK, CSP, etc) this grant applies to
refresh_token:
type: string
description: The token to use to get an updated access token
scope:
type: string
description: The scope of the grant
identity:
type: string
description: The identity the grant is for
Web_SDK_Authentication_AuthorizeOAuthRequest_jwt:
type: object
properties:
client_id:
type: string
description: Client (Application) ID
jwt:
type: string
description: Trusted Json Web Token
scope:
type: string
description: Desired Scope
Web_SDK_Authentication_AuthorizeOAuthResponse_integrated:
type: object
properties:
access_token:
type: string
description: The scope (WebSDK, CSP, etc) this grant applies to
refresh_token:
type: string
description: The token to use to get an updated access token
scope:
type: string
description: The scope of the grant
identity:
type: string
description: The identity the grant is for
Web_SDK_Authentication_AuthorizeOAuthResponse:
type: object
properties:
access_token:
type: string
description: The scope (WebSDK, CSP, etc) this grant applies to
refresh_token:
type: string
description: The token to use to get an updated access token
error:
type: string
description: OAuth Error
error_description:
type: string
description: OAuth Error description
expires:
type: integer
description: The date and time (UTC) when the access token expires
format: int64
expires_in:
type: integer
description: The number of seconds until the token expires
format: int64
token_type:
type: string
description: The application this grant applies to
scope:
type: string
description: The scope of the grant
identity:
type: string
description: The identity the grant is for
refresh_until:
type: integer
description: Unixtime when the grant expires and cannot be refreshed anymore
format: int64
device_code:
type: string
description: Device code. Used to poll "token" endpoint.
user_code:
type: string
description: User code. Used to approve or reject the authorization request.
verification_uri:
type: string
description: Verification URI. This URL is supposed to be opened by the user.
verification_uri_complete:
type: string
description: Verification URI that has user code as part of it.
interval:
type: integer
description: The minimum amount of time in seconds that the client should wait between polling requests to the token endpoint.
format: int64
description: Holds information about a particular access grant
securitySchemes:
AccessToken:
type: http
scheme: bearer