Elium Authentication

generated: '2026-08-17'
method: searched
source: https://learn.elium.com/en/api/getting_started/authentication
docs:
- https://learn.elium.com/en/api/getting_started/authentication
- https://learn.elium.com/en/api/getting_started/quick_start
- https://help.elium.com/en/articles/12767574-mcp
note: >-
  Derived nothing from OpenAPI - Elium publishes no OpenAPI. This profile is read from the provider's own
  authentication guide. Every URL is per-tenant: Elium runs one platform per subdomain, so the
  authorization, token and revocation endpoints live on the customer's own {platform}.elium.com host.
summary:
  types: [oauth2]
  api_key_in: []
  oauth2_flows: [authorizationCode, password, refreshToken]
  scopes: [apiv1]
  token_type: Bearer
  api_key_alternative: none
  api_key_note: >-
    Elium publishes no API-key or personal-access-token path. Every call is OAuth 2.0 on behalf of a user;
    server-to-server integrations are documented as a password grant against a dedicated service user
    account.
schemes:
- name: OAuth2
  type: oauth2
  source: https://learn.elium.com/en/api/getting_started/authentication
  applies_to:
  - GraphQL API (https://{platform}.elium.com/graphql)
  - MCP server (https://{platform}.elium.com/services/mcp)
  flows:
  - flow: authorizationCode
    authorizationUrl: https://{platform}.elium.com/oauth/authorize
    tokenUrl: https://{platform}.elium.com/oauth/token
    refreshUrl: https://{platform}.elium.com/oauth/token
    scopes: {apiv1: Full access to the Elium API on behalf of the authenticated user}
    use: Server-side applications acting for an interactive Elium user.
  - flow: password
    tokenUrl: https://{platform}.elium.com/oauth/token
    scopes: {apiv1: Full access to the Elium API on behalf of the authenticated user}
    use: >-
      Backend / unattended operations. The provider's guide directs integrators to create a dedicated user
      account for this grant rather than reusing a human account.
  - flow: refreshToken
    tokenUrl: https://{platform}.elium.com/oauth/token
    use: Renews the access token; a new access token AND a new refresh token are issued on each renewal.
tokens:
  type: Bearer
  header: 'Authorization: Bearer <access_token>'
  expires_in: 3600
  expires_in_unit: seconds
  refresh: supported
  revocation:
    endpoint: https://{platform}.elium.com/oauth/revoke
    method: POST
    parameters: [token, client_id, client_secret]
    effect: Revokes the access token and its refresh token immediately.
client_registration:
  mechanism: Connected App
  where: Security tab of the Elium administration panel
  requires_role: administrator (system role)
  fields: [name, redirect URL, trusted flag]
  trusted_flag_effect: >-
    A Connected App marked "trusted" skips the end-user approval screen, for pre-approved corporate
    applications.
  dynamic_client_registration: available on request (documented for the MCP surface)
  docs: https://help.elium.com/en/articles/12767574-mcp
authorization_model:
  enforcement: per-user
  detail: >-
    Access is always evaluated against the authenticated user's own permissions. For MCP the provider
    states it plainly: "Every tool runs with the permissions of the authenticated user, so an assistant
    can only ever access content that user is already allowed to see in Elium."
  sso:
    supported: true
    protocols: [SAML 2.0, OpenID Connect]
    note: >-
      Enterprise directory SSO (including ADFS/Microsoft) is documented as a platform control, separate
      from API authentication. Source https://elium.com/trust/controls.
  mfa:
    supported: true
    graphql_operations: [meActivateTwoFactor, meRemoveTwoFactor]
gaps:
- No RFC 8414 authorization-server metadata and no OIDC discovery document are served (see
  well-known/elium-well-known.yml) - a client cannot discover the endpoints programmatically.
- A single coarse scope (apiv1) grants the whole API; there is no read/write or per-resource scoping.
- No client-credentials grant is documented, so genuine machine-to-machine access is modelled as a
  password grant against a service user.