Armor Authentication

generated: '2026-08-06'
method: searched
source: openapi/armor-accounts-openapi-original.yml, openapi/armor-agent-management-openapi-original.yml,
  openapi/armor-compliance-openapi-original.yml, openapi/armor-container-security-openapi-original.yml,
  openapi/armor-fh-auth-openapi-original.yml, openapi/armor-incident-management-openapi-original.yml,
  openapi/armor-infrastructure-management-openapi-original.yml, openapi/armor-log-management-openapi-original.yml,
  openapi/armor-mdr-public-openapi-original.yml, openapi/armor-notifications-openapi-original.yml, openapi/armor-psk-auth-openapi-original.yml,
  openapi/armor-v1-account-management-swagger-original.json ...
summary:
  types:
  - apiKey
  - http
  - oauth2
  api_key_in:
  - header
  oauth2_flows:
  - authorizationCode
  - clientCredentials
schemes:
- name: OAuth2
  type: oauth2
  flows:
  - flow: clientCredentials
    tokenUrl: https://api.armor.com/auth/authorize
    scopes: 0
  description: OAuth 2.0 authentication with scopes
  sources:
  - openapi/armor-accounts-openapi-original.yml
  - openapi/armor-agent-management-openapi-original.yml
  - openapi/armor-container-security-openapi-original.yml
  - openapi/armor-incident-management-openapi-original.yml
  - openapi/armor-infrastructure-management-openapi-original.yml
  - openapi/armor-notifications-openapi-original.yml
  - openapi/armor-webhooks-openapi-original.yml
- name: ApiKey
  type: apiKey
  in: header
  parameter: x-api-key
  description: API Key authentication
  sources:
  - openapi/armor-agent-management-openapi-original.yml
  - openapi/armor-infrastructure-management-openapi-original.yml
- name: FHAuth
  type: apiKey
  in: header
  parameter: Authorization
  description: FH Auth authentication
  sources:
  - openapi/armor-agent-management-openapi-original.yml
  - openapi/armor-infrastructure-management-openapi-original.yml
  - openapi/armor-psk-auth-openapi-original.yml
  - openapi/armor-v1-account-management-swagger-original.json
  - openapi/armor-v1-infrastructure-swagger-original.json
  - openapi/armor-v1-security-swagger-original.json
  - openapi/armor-v1-support-swagger-original.json
- name: OAuth2
  type: oauth2
  flows:
  - flow: authorizationCode
    authorizationUrl: https://auth.armor.com/authorize
    tokenUrl: https://auth.armor.com/token
    scopes: 0
  sources:
  - openapi/armor-compliance-openapi-original.yml
  - openapi/armor-log-management-openapi-original.yml
- name: FH-AUTH
  type: http
  scheme: bearer
  bearerFormat: FH-AUTH
  description: |-
    FH-AUTH token authentication.

    ## Authentication Flow

    1. **Authorize**: POST credentials to `/auth/authorize` to receive an authorization code
    2. **Token Exchange**: Exchange the code at `/auth/token` within 2 minutes for access tokens
    3. **API Calls**: Use the access token in the `Authorization: FH-AUTH {token}` header
    4. **Refresh**: When token expires (15 minutes), refresh via `/auth/token/rei
  sources:
  - openapi/armor-fh-auth-openapi-original.yml
  - openapi/armor-mdr-public-openapi-original.yml
- name: X-Account-Context
  type: apiKey
  in: header
  parameter: X-Account-Context
  description: X-Account-Context
  sources:
  - openapi/armor-v1-account-management-swagger-original.json
  - openapi/armor-v1-infrastructure-swagger-original.json
  - openapi/armor-v1-security-swagger-original.json
  - openapi/armor-v1-support-swagger-original.json
docs: https://developer.armor.com/
portal_documented:
  source: https://developer.armor.com/ (Authentication page, rendered from the portal JS bundle)
  statement: Armor Service APIs support multiple authentication methods; each resource declares which
    schemes it supports.
  schemes:
  - name: OAuth2 (Scoped)
    preferred: true
    header: 'authorization: Bearer $ID_TOKEN,$ACCESS_TOKEN'
    note: Requires BOTH an ID token and a scoped access token, comma-separated in one Bearer header. Armor
      states this is the preferred method and that all future APIs will support it.
  - name: OAuth2
    header: 'authorization: Bearer $ID_TOKEN'
    note: ID token only.
  - name: Pre-Shared Key (ARMOR-PSK)
    header: 'authorization: ARMOR-PSK $API_KEY_ID,$REQUEST_SIGNATURE'
    note: HMAC-SHA512 signature over api_key_id + http_method + request_path + nonce + timestamp + request_body,
      base64 encoded. The secret key is used directly as a UTF-8 string, not base64-decoded. Keys are
      generated in the Armor Management Portal under Account > Users > API Keys. No token refresh is needed.
  id_token_flow:
    issuer: https://sts.armor.com/adfs/oauth2/authorize
    protocol: AD FS OAuth 2.0, response_type=id_token, response_mode=form_post
    steps:
    - POST credentials with AuthMethod=FormsAuthentication; follow the 302
    - Parse the returned HTML form for the MFA Context value, POST again with AuthMethod=AzureMfaServerAuthentication
    - Parse the id_token input out of the resulting HTML form
    clients:
    - client_id: b2264823-30a3-4706-bf48-4cf80dad76d3
      use: default interactive client; MFA required
    - client_id: d467ba47-2382-44cd-8779-5fb9a3abf69b
      use: service accounts and non-interactive sessions; MFA not required, but the account must be explicitly
        excluded from MFA by support ticket
    note: The ID token is delivered inside an HTML form, so a client must scrape it with XPath or an HTML
      parser. This is a notable machine-unfriendliness in an otherwise machine-readable platform.
  access_token_flow:
    endpoint: POST https://api.armor.com/auth/token
    requires: 'a valid ID token in the authorization: Bearer header, a space-delimited scope query parameter,
      and a request body of exactly null'
    response:
      assertion: the scoped access token, a JWT
      scope: space-separated list of granted scopes
      token_type: jwt-bearer
    note: Requested scopes the user has no permission for are silently dropped from the returned scope
      list rather than erroring.
  mfa:
    required_by_default: true
    exception: service accounts using the non-interactive client_id, after an approved support ticket
      excludes the account from MFA
account_context:
  header: X-Account-Context
  required: true
  note: Declared as an apiKey securityScheme in all four v1 Swagger documents and as a parameter on both
    /me operations; it names the Armor account the request acts on.