Cloudbees Authentication

generated: '2026-09-05'
method: searched
source: openapi/cloudbees-computer-api-openapi.yml, openapi/cloudbees-createitem-api-openapi.yml, openapi/cloudbees-job-api-openapi.yml,
  openapi/cloudbees-json-api-openapi.yml, openapi/cloudbees-python-api-openapi.yml, openapi/cloudbees-queue-api-openapi.yml,
  openapi/cloudbees-unify-beta-openapi.yml, openapi/cloudbees-unify-openapi.yml, openapi/cloudbees-xml-api-openapi.yml;
  upgraded from the CloudBees docs (personal access tokens, CloudBees CI API authentication) and live probes of
  the OAuth/OIDC discovery documents on 2026-09-05
summary:
  types:
  - apiKey
  - http
  - oauth2
  - openIdConnect
  note: http/bearer and http/basic are what the harvested OpenAPI documents declare; oauth2, openIdConnect and apiKey
    come from the additional surfaces below, which have no published OpenAPI.
schemes:
- name: basicAuth
  type: http
  scheme: basic
  description: Jenkins username + API token
  sources:
  - openapi/cloudbees-computer-api-openapi.yml
  - openapi/cloudbees-createitem-api-openapi.yml
  - openapi/cloudbees-job-api-openapi.yml
  - openapi/cloudbees-json-api-openapi.yml
  - openapi/cloudbees-python-api-openapi.yml
  - openapi/cloudbees-queue-api-openapi.yml
  - openapi/cloudbees-xml-api-openapi.yml
  surface: CloudBees CI (Jenkins-compatible) controllers — customer-operated
  header: 'Authorization: Basic base64(<username>:<api_token>)'
  docs: https://docs.cloudbees.com/docs/cloudbees-ci-api/latest/api-authentication
  note: CloudBees CI API tokens are generated in the UI, can be revoked at any time, and work interchangeably across
    the REST API and the Jenkins CLI (-auth username:token).
- name: BearerAuth
  type: http
  scheme: bearer
  description: CloudBees Unify API access token or personal access token
  sources:
  - openapi/cloudbees-unify-beta-openapi.yml
  - openapi/cloudbees-unify-openapi.yml
  surface: CloudBees Unify Public API (https://api.cloudbees.io)
  header: 'Authorization: Bearer <personal_access_token>'
  token_types:
  - personal access token (PAT)
  - CloudBees Unify API access token
  docs: https://docs.cloudbees.com/docs/cloudbees-platform/latest/workflows/personal-access-token
  note: PATs are created in the CloudBees Unify UI under the user profile and inherit that user's permissions —
    there is no scope narrowing on the REST surface.
docs: https://docs.cloudbees.com/docs/cloudbees-platform/latest/workflows/personal-access-token
additional_surfaces:
- name: CloudBees Unify MCP Server
  endpoint: https://mcp.cloudbees.io/v1/mcp
  type: oauth2
  flow: authorizationCode
  authorization_servers:
  - https://id.cloudbees.io/realms/cloudbees
  scopes:
  - openid
  - profile
  - email
  - mcp:unify:connect
  discovery: https://mcp.cloudbees.io/.well-known/oauth-protected-resource
  evidence: RFC 9728 protected-resource document + WWW-Authenticate Bearer challenge observed 2026-09-05
  cross_ref: scopes/cloudbees-scopes.yml
- name: CloudBees Feature Management REST API
  endpoint: https://x-api.rollout.io/public-api
  type: http
  scheme: bearer
  header: 'Authorization: Bearer <API_TOKEN>'
  docs: https://docs.cloudbees.com/docs/cloudbees-feature-management-rest-api/latest/introduction
- name: CloudBees CD/RO REST API
  endpoint: https://<cd-server>/rest/v1.0/
  type: apiKey
  in: header
  parameter: sessionid
  docs: https://docs.cloudbees.com/docs/cloudbees-cd-api-rest/latest/
  note: Session id from `ectool login`, or a user-generated API token, passed as a sessionid header.
- name: CloudBees Unify workload identity (OIDC issuer)
  issuer: https://api.cloudbees.io
  type: openIdConnect
  discovery: https://api.cloudbees.io/.well-known/openid-configuration
  response_types_supported:
  - id_token
  claims:
  - sub
  - aud
  - exp
  - iat
  - iss
  - jti
  - nbf
  - ref
  - repository
  - run_id
  - run_number
  - run_attempt
  note: Issues id_tokens identifying a workflow RUN, for federating CloudBees Unify workflows into cloud providers
    without static credentials. Not a user-facing login.
  file: well-known/cloudbees-api-openid-configuration.json