Cloud Foundry · Authentication Profile

Cloud Foundry Authentication

Authentication

Cloud Foundry secures its APIs with http, mutualTLS, and oauth2 across 4 declared security schemes, as derived from its OpenAPI definitions. OAuth 2.0 is offered via the implicit flow(s).

Cloud Foundry FoundationContainersMulti-CloudOpen-SourcePlatform-as-a-ServicePlatform
Methods: http, mutualTLS, oauth2 Schemes: 4 OAuth flows: implicit API key in:

Security Schemes

bearerAuth http
scheme: bearer
mtls mutualTLS
basicAuthentication http
scheme: basic
oauth oauth2
· flows: implicit

Source

Authentication Profile

Raw ↑ 
generated: '2026-09-05'
method: searched
source: openapi/cloud-foundry-app-autoscaler-application-metric-api-openapi.yaml, openapi/cloud-foundry-app-autoscaler-custom-metrics-api-openapi.yaml,
  openapi/cloud-foundry-app-autoscaler-policy-api-openapi.yaml, openapi/cloud-foundry-app-autoscaler-scaling-history-api-openapi.yaml,
  openapi/cloud-foundry-apps-api-openapi.yml, openapi/cloud-foundry-builds-api-openapi.yml, openapi/cloud-foundry-capi-v3-openapi.yaml,
  openapi/cloud-foundry-cloud-foundry-cloud-controller-api-v3-api-openapi.yml, openapi/cloud-foundry-deployments-api-openapi.yml,
  openapi/cloud-foundry-jobs-api-openapi.yml, openapi/cloud-foundry-open-service-broker-api-openapi.yaml, openapi/cloud-foundry-organizations-api-openapi.yml
  ...
summary:
  types:
  - http
  - mutualTLS
  - oauth2
  oauth2_flows:
  - implicit
schemes:
- name: bearerAuth
  type: http
  scheme: bearer
  bearerFormat: JWT
  sources:
  - openapi/cloud-foundry-app-autoscaler-application-metric-api-openapi.yaml
  - openapi/cloud-foundry-app-autoscaler-policy-api-openapi.yaml
  - openapi/cloud-foundry-app-autoscaler-scaling-history-api-openapi.yaml
  - openapi/cloud-foundry-apps-api-openapi.yml
  - openapi/cloud-foundry-builds-api-openapi.yml
  - openapi/cloud-foundry-capi-v3-openapi.yaml
  - openapi/cloud-foundry-cloud-foundry-cloud-controller-api-v3-api-openapi.yml
  - openapi/cloud-foundry-deployments-api-openapi.yml
  - openapi/cloud-foundry-jobs-api-openapi.yml
  - openapi/cloud-foundry-organizations-api-openapi.yml
  - openapi/cloud-foundry-service-instances-api-openapi.yml
  - openapi/cloud-foundry-spaces-api-openapi.yml
- name: mtls
  type: mutualTLS
  description: Use the Instance Identity Credentials provided by the Cloud Foundry runtime
  sources:
  - openapi/cloud-foundry-app-autoscaler-custom-metrics-api-openapi.yaml
- name: basicAuthentication
  type: http
  scheme: basic
  sources:
  - openapi/cloud-foundry-app-autoscaler-custom-metrics-api-openapi.yaml
  - openapi/cloud-foundry-open-service-broker-api-openapi.yaml
- name: oauth
  type: oauth2
  flows:
  - flow: implicit
    authorizationUrl: https://uaa.cloudfoundry.local/api-oauth/dialog
    scopes: 7
  sources:
  - openapi/cloud-foundry-capi-v3-openapi.yaml
docs:
- https://docs.cloudfoundry.org/uaa/
- https://docs.cloudfoundry.org/api/uaa/
- https://docs.cloudfoundry.org/concepts/architecture/uaa.html
- https://github.com/cloudfoundry/uaa
note: 'Cloud Foundry does not run an identity service — it ships one. Every foundation deploys its own User Account
  and Authentication (UAA) server at uaa.<system-domain>, an OAuth 2.0 / OpenID Connect authorization server with
  SCIM 2.0 user and group management, and SAML/LDAP/OIDC federation. There is no central Cloud Foundry account,
  no API key to obtain, and no signup: credentials belong to whoever runs the deployment you are calling. `cf oauth-token`
  prints the current bearer JWT from an authenticated cf CLI session and is the practical bridge from the CLI to
  any HTTP client.

  The four schemes below span the whole profile and are NOT interchangeable: the Cloud Controller takes UAA-issued
  bearer JWTs; the App Autoscaler custom-metrics endpoint takes mutual TLS using the Instance Identity credentials
  the runtime injects into the container (the only mTLS surface here, and a genuinely strong choice for an in-container
  caller); the Open Service Broker contract takes HTTP Basic between platform and broker. Authorization then adds
  a second axis — see scopes/cloud-foundry-scopes.yml.'
discovery:
  openid_configuration: https://uaa.<system-domain>/.well-known/openid-configuration
  probed: false
  note: 'Not probed: there is no public UAA instance. Every /.well-known/ path on every Foundation-controlled host
    404s (well-known/cloud-foundry-well-known.yml).'

Work with this as data

Every security artifact here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for security posture

4 MCP tools reach this
  • find_securityBrowse and filter every security artifact in the catalog.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This security artifact 
curl "https://apis.io/api/v1/security/cloud-foundry-authentication"
All security posture 
curl "https://apis.io/api/v1/security?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.