Incorta Authentication

generated: '2026-07-19'
method: searched
source: https://docs.incorta.com/latest/references-public-api-v2/
docs: https://docs.incorta.com/latest/references-public-api-v2/
# Incorta Public API v2 authenticates with a bearer access token that is either a
# Personal Access Token (PAT) or an OAuth 2.0 JWT issued by a user-configured
# OAuth 2.0 authorization server. A Super User / SuperRole first enables public
# API access for the user or group. (v1 used a generated API key instead.)
summary:
  types: [http, oauth2]
  http_scheme: bearer
  token_kinds: [personal-access-token, oauth2-jwt]
  authorization_model: role-based (SuperRole, Schema Manager, entity access rights)
schemes:
- name: personalAccessToken
  type: http
  scheme: bearer
  description: >-
    PAT generated in the Incorta Profile Manager. Sent as
    'Authorization: Bearer {PAT}'.
  sources: [docs]
- name: oauth2Jwt
  type: http
  scheme: bearer
  bearerFormat: JWT
  description: >-
    OAuth 2.0 JWT issued by a user-configured OAuth 2.0 authorization server;
    sent as 'Authorization: Bearer {JWT}'. Scopes/claims are defined by the
    external authorization server, not by Incorta.
  sources: [docs]
notes:
- Public API access must be enabled per user/group by a Super User or SuperRole.
- v1 (releases 5.0+) authenticated with a generated API key; v2 (6.0+) uses PAT or JWT.