Fenergo · Authentication Profile

Fenergo Authentication

Authentication

Fenergo secures its APIs with oauth2, openIdConnect, apiKey, http, and mutualTLS across 3 declared security schemes, as derived from its OpenAPI definitions. OAuth 2.0 is offered via the clientCredentials and authorizationCode flow(s).

ComplianceFinancial ServicesKYCAMLOnboardingClient Lifecycle ManagementTransaction MonitoringScreeningRisk ManagementRegTechSoftware-as-a-ServiceIdentity
Methods: oauth2, openIdConnect, apiKey, http, mutualTLS Schemes: 3 OAuth flows: clientCredentials, authorizationCode API key in: header

Security Schemes

Bearer apiKey
· in: header (Authorization)
exportToken oauth2
· flows: clientCredentials
HTTPBearer http
scheme: bearer

Source

Authentication Profile

Raw ↑ 
generated: '2026-09-09'
method: searched
source: https://docs.fenergox.com/api-docs/fenergo-saas-api-specifications/authentication
docs:
- https://docs.fenergox.com/api-docs/fenergo-saas-api-specifications/authentication
- https://docs.fenergox.com/api-docs/tenant-access
- https://docs.fenergox.com/developer-hub/api-and-system-security/api-scopes-and-access-control
- https://docs.fenergox.com/developer-hub/api-and-system-security/api-security-and-best-practice
summary:
  types:
  - oauth2
  - openIdConnect
  - apiKey
  - http
  - mutualTLS
  api_key_in:
  - header
  oauth2_flows:
  - clientCredentials
  - authorizationCode
  primary: OAuth 2.0 client_credentials against Duende IdentityServer; Bearer JWT in the Authorization header
model:
  identity_provider: Duende IdentityServer (Enterprise Edition)
  issuer: https://identity.fenergox.com
  token_endpoint: https://identity.fenergox.com/connect/token
  mtls_token_endpoint: https://api-mtls.fenergox.com/sts/connect/mtls/token
  regional_pattern: https://identity.{region}.fenergox.com/connect/token
  token_type: Bearer JWT
  token_ttl_seconds: 900
  recommended_grant: client_credentials
  sso: Client IdPs supported via OIDC, SAML, WS-Fed and Google Auth for UI users; portal users via Auth0
  username_password: Not supported for API access — credentials are exchanged once for a short-lived access token
required_headers:
- header: Authorization
  value: Bearer {access_token}
  required: true
  note: Declared in 130 of the harvested OpenAPI contracts as an apiKey securityScheme named "Bearer" in the header.
- header: x-tenant-id
  value: '{tenant GUID}'
  required: true
  note: Mandatory on every CLM API call and declared as a parameter on 2,324 of the 2,381 harvested operations.
    A missing header returns HTTP 400 with errorCode MissingTenantHeader. It is NOT required on the token request
    itself.
- header: x-correlation-id
  value: '{GUID}'
  required: false
  note: Optional tracing header, declared on 86 operations; propagated onto event notifications as correlationId.
mutual_tls:
  supported: true
  token_endpoint_auth_methods:
  - client_secret_basic
  - client_secret_post
  - tls_client_auth
  - self_signed_tls_client_auth
  endpoint: https://api-mtls.fenergox.com/sts/connect/mtls/token
  source: https://docs.fenergox.com/developer-hub/api-and-system-security/api-security-and-best-practice
scopes:
  artifact: scopes/fenergo-scopes.yml
  documented_count: 105
  docs: https://docs.fenergox.com/developer-hub/api-and-system-security/api-scopes-and-access-control
caching_guidance: Fenergo instructs clients to cache and reuse the access token for its full 15-minute TTL; the
  identity domain is limited to 100 token requests per IP per 5 minutes.
schemes:
- name: Bearer
  type: apiKey
  in: header
  parameter: Authorization
  description: Please insert JWT with Bearer into field
  sources:
  - openapi/fenergo-advanceddashboardcommand-v1-0-openapi.json
  - openapi/fenergo-advanceddashboardquery-v1-0-0-openapi.json
  - openapi/fenergo-associationcommand-v1-0-openapi.json
  - openapi/fenergo-associationcommand-v2-0-openapi.json
  - openapi/fenergo-associationquery-v1-0-openapi.json
  - openapi/fenergo-auditquery-v1-0-openapi.json
  - openapi/fenergo-auditquery-v2-0-openapi.json
  - openapi/fenergo-auditquery-v3-0-openapi.json
  - openapi/fenergo-authorizationcommand-v1-0-openapi.json
  - openapi/fenergo-authorizationquery-v1-0-openapi.json
  - openapi/fenergo-authorizationquery-v2-0-openapi.json
  - openapi/fenergo-authorizationquery-v3-0-openapi.json
  - openapi/fenergo-bulkloadcommand-v1-0-openapi.json
  - openapi/fenergo-bulkloadcommand-v2-0-openapi.json
  - openapi/fenergo-bulkloadquery-v1-0-openapi.json
  - openapi/fenergo-businessmetricscommand-v1-0-0-openapi.json
  - openapi/fenergo-businessmetricsquery-v1-0-openapi.json
  - openapi/fenergo-changemanagementcommand-v1-0-openapi.json
  - openapi/fenergo-changemanagementquery-v1-0-openapi.json
  - openapi/fenergo-collateralcommand-v1-0-openapi.json
  - openapi/fenergo-collateralquery-v1-0-openapi.json
  - openapi/fenergo-configbaselinecommand-v1-7-2-openapi.json
  - openapi/fenergo-configbaselinequery-v1-9-3-openapi.json
  - openapi/fenergo-configexchangecommand-v1-0-openapi.json
  - openapi/fenergo-configexchangequery-v1-0-openapi.json
  - openapi/fenergo-configreleasehubcommand-v1-0-openapi.json
  - openapi/fenergo-covenantsconditionscommand-v1-0-openapi.json
  - openapi/fenergo-covenantsconditionsquery-v1-0-openapi.json
  - openapi/fenergo-creditassessmentcommand-v1-0-openapi.json
  - openapi/fenergo-creditassessmentquery-v1-0-openapi.json
  - openapi/fenergo-creditscreeningcommand-v1-0-openapi.json
  - openapi/fenergo-creditscreeningquery-v1-0-openapi.json
  - openapi/fenergo-dashboardscommand-v1-0-0-openapi.json
  - openapi/fenergo-dashboardsquery-v1-0-0-openapi.json
  - openapi/fenergo-datamigrationcommand-v1-0-openapi.json
  - openapi/fenergo-datamigrationcommand-v2-0-openapi.json
  - openapi/fenergo-datamigrationquery-v1-0-openapi.json
  - openapi/fenergo-dataprotectioncommand-v1-0-openapi.json
  - openapi/fenergo-dataprotectionquery-v1-0-openapi.json
  - openapi/fenergo-dealscommand-v1-0-openapi.json
  - openapi/fenergo-dealsquery-v1-0-openapi.json
  - openapi/fenergo-digitalagentscommand-v1-0-openapi.json
  - openapi/fenergo-digitalagentsquery-v1-0-openapi.json
  - openapi/fenergo-digitalidvcommand-v1-0-openapi.json
  - openapi/fenergo-digitalidvcommand-v2-0-openapi.json
  - openapi/fenergo-digitalidvquery-v1-0-openapi.json
  - openapi/fenergo-digitalidvquery-v2-0-openapi.json
  - openapi/fenergo-docgencommand-v1-0-openapi.json
  - openapi/fenergo-docgenquery-v1-0-openapi.json
  - openapi/fenergo-documentmanagementcommand-v1-0-openapi.json
  - openapi/fenergo-documentmanagementcommand-v2-0-openapi.json
  - openapi/fenergo-documentmanagementquery-v1-0-openapi.json
  - openapi/fenergo-entitydatacommand-v1-0-openapi.json
  - openapi/fenergo-entitydatacommand-v2-0-openapi.json
  - openapi/fenergo-entitydatacommand-v3-0-openapi.json
  - openapi/fenergo-entitydataquery-v1-0-openapi.json
  - openapi/fenergo-entitydataquery-v2-0-openapi.json
  - openapi/fenergo-entityprofilecommand-v1-0-openapi.json
  - openapi/fenergo-entityprofilequery-v1-0-openapi.json
  - openapi/fenergo-eventingress-v1-0-openapi.json
  - openapi/fenergo-eventnotifications-v1-0-openapi.json
  - openapi/fenergo-eventnotifications-v2-0-openapi.json
  - openapi/fenergo-externalauthenticationcommand-v1-0-openapi.json
  - openapi/fenergo-externalauthenticationquery-v1-0-openapi.json
  - openapi/fenergo-externaldatabff-v1-0-openapi.json
  - openapi/fenergo-externaldatacommand-v1-0-openapi.json
  - openapi/fenergo-externaldataquery-v1-0-openapi.json
  - openapi/fenergo-externaloutreachcommand-v1-0-openapi.json
  - openapi/fenergo-externaloutreachcommand-v2-0-openapi.json
  - openapi/fenergo-externaloutreachcommand-v3-0-openapi.json
  - openapi/fenergo-externaloutreachquery-v1-0-openapi.json
  - openapi/fenergo-financialanalysiscommand-v1-0-openapi.json
  - openapi/fenergo-financialanalysisquery-v1-0-openapi.json
  - openapi/fenergo-identity-scim-v1-openapi.json
  - openapi/fenergo-identitymanagementcommand-v1-0-openapi.json
  - openapi/fenergo-identitymanagementquery-v1-0-openapi.json
  - openapi/fenergo-integrationcore-v1-0-openapi.json
  - openapi/fenergo-journeycommand-v1-0-openapi.json
  - openapi/fenergo-journeylogicengine-v1-0-openapi.json
  - openapi/fenergo-journeylogicengine-v2-0-openapi.json
  - openapi/fenergo-journeyquery-v1-0-openapi.json
  - openapi/fenergo-localisationcommand-v1-0-openapi.json
  - openapi/fenergo-localisationquery-v1-0-openapi.json
  - openapi/fenergo-logging-centre-v1-0-openapi.json
  - openapi/fenergo-lookupcommand-v1-0-openapi.json
  - openapi/fenergo-lookupquery-v1-0-openapi.json
  - openapi/fenergo-narrativecommand-v1-0-openapi.json
  - openapi/fenergo-narrativequery-v1-0-openapi.json
  - openapi/fenergo-newrequest-v1-0-openapi.json
  - openapi/fenergo-outreachcommand-v1-0-0-openapi.json
  - openapi/fenergo-outreachquery-v1-0-0-openapi.json
  - openapi/fenergo-policyagent-v1-0-openapi.json
  - openapi/fenergo-policycommand-v1-0-openapi.json
  - openapi/fenergo-policycommand-v2-0-openapi.json
  - openapi/fenergo-policylogicengine-v1-0-openapi.json
  - openapi/fenergo-policylogicengine-v2-0-openapi.json
  - openapi/fenergo-policylogicengine-v3-0-openapi.json
  - openapi/fenergo-policyproviderscommand-v1-0-openapi.json
  - openapi/fenergo-policyprovidersquery-v1-0-openapi.json
  - openapi/fenergo-policyquery-v1-0-openapi.json
  - openapi/fenergo-policyquery-v2-0-openapi.json
  - openapi/fenergo-policyquery-v3-0-openapi.json
  - openapi/fenergo-policyquery-v4-0-openapi.json
  - openapi/fenergo-portal-bff-v1-0-0-0-openapi.json
  - openapi/fenergo-portaltenantcommand-v4-0-openapi.json
  - openapi/fenergo-portaltenantquery-v4-0-openapi.json
  - openapi/fenergo-productcommand-v1-0-openapi.json
  - openapi/fenergo-productpolicycommand-v1-0-openapi.json
  - openapi/fenergo-productpolicylogicengine-v1-0-openapi.json
  - openapi/fenergo-productpolicyquery-v1-0-openapi.json
  - openapi/fenergo-productquery-v1-0-openapi.json
  - openapi/fenergo-reportingquery-v1-0-0-openapi.json
  - openapi/fenergo-reportscommand-v1-0-openapi.json
  - openapi/fenergo-reportscommand-v2-0-openapi.json
  - openapi/fenergo-reportsquery-v1-0-openapi.json
  - openapi/fenergo-reportsquery-v2-0-openapi.json
  - openapi/fenergo-reviewcommand-v1-0-openapi.json
  - openapi/fenergo-reviewquery-v1-0-openapi.json
  - openapi/fenergo-riskcommand-v1-0-openapi.json
  - openapi/fenergo-riskquery-v1-0-openapi.json
  - openapi/fenergo-screeningcommand-v1-0-openapi.json
  - openapi/fenergo-screeningcommand-v2-0-openapi.json
  - openapi/fenergo-screeningcommand-v3-0-openapi.json
  - openapi/fenergo-screeningquery-v1-0-openapi.json
  - openapi/fenergo-screeningquery-v2-0-openapi.json
  - openapi/fenergo-screeningquery-v3-0-openapi.json
  - openapi/fenergo-screeningquery-v4-0-openapi.json
  - openapi/fenergo-significancecommand-v1-0-openapi.json
  - openapi/fenergo-significancequery-v1-0-openapi.json
  - openapi/fenergo-smartdocs-v1-0-openapi.json
  - openapi/fenergo-webhooks-v1-0-openapi.json
- name: exportToken
  type: oauth2
  flows:
  - flow: clientCredentials
    tokenUrl: https://your_api_endpoint/oauth2/token
    scopes: 1
  sources:
  - openapi/fenergo-tm-dataexport-api-spec-openapi.json
  - openapi/fenergo-tm-realtime-api-spec-openapi.json
  - openapi/fenergo-tm-rule-execution-api-spec-openapi.json
  - openapi/fenergo-tm-rule-rerun-api-spec-openapi.json
  - openapi/fenergo-tm-rule-scheduling-api-spec-openapi.json
  - openapi/fenergo-tm-transaction-batch-api-spec-openapi.json
- name: HTTPBearer
  type: http
  scheme: bearer
  sources:
  - openapi/fenergo-tm-profile-api-spec-openapi.json
x-evidence:
- url: https://identity.fenergox.com/.well-known/openid-configuration
  http_status: 200
  fetched: '2026-09-09'
- url: https://api.fenergox.com/entitydataquery/swagger/swagger-ui-init.js
  http_status: 400
  note: Returned {"ErrorCode":"MissingTenantHeader"} — confirms the tenant header is enforced at the gateway.

Work with this as data

Every security artifact here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for security posture

4 MCP tools reach this
  • find_securityBrowse and filter every security artifact in the catalog.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This security artifact 
curl "https://apis.io/api/v1/security/fenergo-authentication"
All security posture 
curl "https://apis.io/api/v1/security?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.