Accountsiq Authentication

generated: '2026-09-06'
method: searched
source: https://accountsiq.github.io/API-Wiki/authentication2.html
docs:
- https://accountsiq.github.io/API-Wiki/authentication2.html
- https://accountsiq.github.io/API-Wiki/authentication1.html
- https://accountsiq.github.io/API-Wiki/specifications.html
note: >-
  AccountsIQ publishes two authentication models side by side, one per WSDL contract.
  Neither is described by an OpenAPI securityScheme — this is a SOAP 1.1 service, so the
  scheme shapes below were read from the provider's own authentication pages and confirmed
  against the WSDL (the AiqSoapHeader complexType and the TokenGet/TokenRefresh operations
  exist in wsdl/accountsiq-integration-2-0.wsdl; Login exists in the 1.1 contract).
  API access is not self-service: an integrator partner key is issued by AccountsIQ after
  the API Terms of Use are acknowledged to integration@accountsiq.com, and production keys
  are separate from staging keys.
schemes:
- id: aiq-oauth2-client-credentials
  api: accountsiq:integration-2-0
  type: oauth2
  flow: client_credentials
  description: >-
    Integration 2.0 authenticates with an OAuth 2.0 client-credentials exchange carried over
    SOAP rather than over a REST token endpoint. TokenGet(clientId, clientSecret) returns a
    TokenGetResponse containing AccessToken and RefreshToken. TokenRefresh(clientId,
    clientSecret, refreshToken) rotates both.
  token_operations:
    obtain: TokenGet
    refresh: TokenRefresh
    response_type: TokenGetResponse
    response_fields:
    - AccessToken
    - RefreshToken
  credential_transport:
    mechanism: soap-header
    header_type: AiqSoapHeader
    fields:
    - name: AccessToken
      description: The bearer access token returned by TokenGet or TokenRefresh.
    - name: Entity
      description: >-
        The AccountsIQ entity (client company) the call operates against. Multi-entity is a
        first-class part of the auth context, not a query parameter — the same credentials
        address different entities by changing this header. GetEntitiesByToken lists the
        entities a token can reach.
  legacy_parameter:
    note: >-
      Every 2.0 operation still takes a token as its first parameter for 1.1 compatibility.
      The provider documents that it should be left BLANK on 2.0 because the token is carried
      in the header instead.
  expiry:
    signal: WSResultStatus.HasExpired
    description: Responses carry a HasExpired boolean; on true, call TokenRefresh.
  scopes:
    published: false
    note: >-
      No OAuth scope surface is published. Authorization is expressed as AccountsIQ user
      permissions rather than scopes — the 2.0 WSDL annotates read operations with the
      documentation string "Read Permission Required." No scopes/ artifact is emitted,
      because asserting a scope list the provider does not publish would be fabrication.
- id: aiq-session-login
  api: accountsiq:integration-1-1
  type: custom-session-token
  description: >-
    Integration 1.1 authenticates with Login(companyID, partnerKey, userKey), which returns a
    session token string. The token is passed as the first parameter of every subsequent
    operation.
  credentials:
  - name: companyID
    description: The AccountsIQ entity / company identifier.
  - name: partnerKey
    description: >-
      Integrator partner key, issued by AccountsIQ. Staging and production keys are different
      sets; production keys must be requested from AccountsIQ directly.
  - name: userKey
    description: End-user integration key, generated inside the customer's AIQ deployment.
  credential_transport:
    mechanism: operation-parameter
    parameter: token (first argument of every method)
  expiry:
    lifetime_minutes: 20
    signal: WSResultStatus.HasExpired
    renewal: Call Login again.
    source: https://accountsiq.github.io/API-Wiki/authentication1.html
regional_endpoints:
  note: >-
    The WSDL is identical across regions; only the host differs. A client must let the user
    pick the region matching their AccountsIQ URL.
  hosts:
  - region: eu1
    base: https://eu1.accountsiq.com/system/dashboard/integration/
  - region: eu2
    base: https://eu2.accountsiq.com/system/dashboard/integration/
  - region: uk1
    base: https://uk1.accountsiq.com/system/dashboard/integration/
  - region: us1
    base: https://us1.accountsiq.com/system/dashboard/integration/
key_handling_obligations:
  source: https://accountsiq.github.io/API-Wiki/authentication1.html
  statements:
  - The integrator partner key is sensitive and the integrator is responsible for its use.
  - Keys must be inaccessible via reverse engineering.
  - The API Terms of Use must be read and acknowledged to integration@accountsiq.com before use.
  - API keys may not be shared with, or borrowed from, a third party (API Terms of Use, clause 1.1).