Cohesity · Authentication Profile

Cohesity Authentication

Authentication

Cohesity secures its APIs with apiKey, oauth2, openIdConnect, and http across 4 declared security schemes, as derived from its OpenAPI definitions. OAuth 2.0 is offered via the authorizationCode flow(s).

AutomationBackupCyber ResilienceData ManagementData ProtectionData SecurityDataProtectDisaster RecoveryHeliosOrchestrationRansomware RecoverySite ContinuityReportingModel Context ProtocolEnterprise Storage

Methods: apiKey, oauth2, openIdConnect, http Schemes: 4 OAuth flows: authorizationCode API key in: header

Security Schemes

APIKeyHeader apiKey

· in: header (apiKey)

Helios OAuth 2.0 / OIDC oauth2

Cluster access token http

scheme: bearer

Cluster session ID apiKey

· in: cookie ()

Source

Authentication Profile

generated: '2026-09-05'
method: searched
source: >-
  openapi/cohesity-cluster-v2-openapi.yml,
  openapi/cohesity-helios-reporting-openapi.yml,
  openapi/cohesity-site-continuity-openapi.yml (securityDefinitions), upgraded
  with https://developers.cohesity.com/docs/getting-started and the live Helios
  OAuth/OIDC discovery documents
docs: https://developers.cohesity.com/docs/getting-started
summary:
  types: [apiKey, oauth2, openIdConnect, http]
  api_key_in: [header]
  oauth2_flows: [authorizationCode]
schemes:
  - name: APIKeyHeader
    type: apiKey
    in: header
    parameter: apiKey
    sources:
      - openapi/cohesity-cluster-v2-openapi.yml
      - openapi/cohesity-helios-reporting-openapi.yml
      - openapi/cohesity-site-continuity-openapi.yml
    description: >-
      The primary automation credential across every Cohesity surface. A Helios
      or cluster API key is created once in the UI (or from an authenticated
      session) and shown only once, then sent on every request in the `apiKey`
      header.
  - name: Helios OAuth 2.0 / OIDC
    type: oauth2
    flow: authorizationCode
    authorizationUrl: https://helios.cohesity.com/oauth2/authorize
    tokenUrl: https://helios.cohesity.com/oauth2/token
    revocationUrl: https://helios.cohesity.com/oauth2/revoke
    jwksUri: https://helios.cohesity.com/oauth2/jwks.json
    issuer: https://helios.cohesity.com
    pkce: [S256]
    scopes_ref: scopes/cohesity-scopes.yml
    sources: [well-known/cohesity-openid-configuration.json]
    description: >-
      Not declared in any published OpenAPI document; discovered from the live
      OIDC and RFC 8414 metadata Helios serves. Public clients are supported
      (token_endpoint_auth_method `none` with PKCE S256).
  - name: Cluster access token
    type: http
    scheme: bearer
    sources: [https://developers.cohesity.com/docs/getting-started]
    description: >-
      On-prem clusters accept username + password + domain at the access-token
      endpoint and return a token used on subsequent calls.
  - name: Cluster session ID
    type: apiKey
    in: cookie
    sources: [https://developers.cohesity.com/docs/getting-started]
    description: >-
      On-prem clusters also support a session-ID cookie obtained from an
      interactive login; this is the cookie used to mint an API key programmatically.
surfaces:
  - surface: Helios (SaaS control plane)
    methods: [api-key, username-password-ui, oauth2]
    mfa: >-
      Multi-factor authentication is supported for interactive sign-in. Cohesity
      documents that enabling MFA does NOT support automation - an important
      operational constraint for any agent or CI credential.
    docs: https://developers.cohesity.com/docs/getting-started
  - surface: On-prem cluster (DataProtect)
    methods: [access-token, session-id, api-key]
    mfa: Supported on all three methods when enabled on the cluster.
    docs: https://developers.cohesity.com/docs/getting-started
  - surface: Gaia Data Insights / Gaia MCP
    methods: [api-key]
    header: apiKey
    privilege: GAIA_VIEW
    docs: https://learn.microsoft.com/en-us/connectors/cohesitygaiamcp/
credential_lifecycle:
  rotation_docs: https://docs.cohesity.com/WebHelios/Content/Helios/Access%20Management.htm
  note: >-
    API keys are displayed exactly once at creation and cannot be retrieved
    afterwards; rotation means issuing a new key and revoking the old one from
    Helios Access Management. OAuth tokens are revocable at the documented
    revocation endpoint.
maintainers:
  - FN: Kin Lane
    email: kin@apievangelist.com

Work with this as data

Every security artifact here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for security posture

4 MCP tools reach this

find_securityBrowse and filter every security artifact in the catalog.
apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
resolveTurn a domain, URL or GitHub org into the provider it belongs to.
find_cohortsEvery scored population of providers in the catalog.

All 92 tools →

Call it yourself

curl for this page

This security artifact

curl "https://apis.io/api/v1/security/cohesity-authentication"

All security posture

curl "https://apis.io/api/v1/security?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.