Striveworks Authentication

generated: '2026-08-05'
method: searched
source: https://production.chariot.striveworks.us/docs/user_guide/administration/authentication
docs: https://production.chariot.striveworks.us/docs/user_guide/administration/authentication
summary:
  types: [oauth2, http, mutualTLS]
  oauth2_flows: [clientCredentials]
  bearer_token: true
  api_key_in: []
  notes: >-
    Chariot is deployed per tenant, so every authentication URL below is relative to the customer's own
    Chariot host (the docs write it as https://<chariot_url>). The Striveworks-operated instance used for
    these probes is https://production.chariot.striveworks.us. There is no published OpenAPI declaring
    securitySchemes, so this profile is captured from the provider's authentication documentation rather
    than derived from a spec.
schemes:
  - name: client_credentials
    type: oauth2
    flow: clientCredentials
    token_url: https://<chariot_url>/auth/client/v2/chariot/login
    grant_type: client_credentials
    request_content_type: application/x-www-form-urlencoded
    request_parameters: [client_id, client_secret, grant_type]
    response_fields: [access_token, expires_in]
    credential_lifetime: >-
      Client credentials are created from the user's Profile page with a name and an expiration date of
      up to one year from the date of creation.
    source: https://production.chariot.striveworks.us/docs/user_guide/administration/authentication
  - name: bearer
    type: http
    scheme: bearer
    in: header
    parameter: Authorization
    format: 'Authorization: Bearer <access_token>'
    description: >-
      Bearer token returned by the client-credentials login endpoint; required on all subsequent
      requests to the Chariot REST API.
    source: https://production.chariot.striveworks.us/docs/user_guide/administration/authentication
  - name: pki
    type: mutualTLS
    description: >-
      PKI / client-certificate authentication for environments that require it. Supported via PKCS#12
      bundle (pkcs12 + pkcs12_password) or separate certificate and key files (cert_filename,
      key_filename), both through the SDK connect() call and directly with an HTTP client. Can be
      combined with a bearer token.
    source: https://production.chariot.striveworks.us/docs/user_guide/administration/authentication
sdk_helpers:
  - language: python
    package: chariot-client
    function: chariot.client.connect
    modes: [client_id + client_secret, bearer_token, pkcs12, cert_filename + key_filename]
  - language: cli
    command: chariot init
    modes: ['--credentials credentials.json', interactive]
authorization_model:
  style: rbac
  docs: https://production.chariot.striveworks.us/docs/user_guide/administration/roles-permissions
  note: >-
    Authorization is role-based over organizations and projects rather than OAuth scopes; no scope
    strings are issued with the access token, so no scopes/ artifact is emitted for this provider.
  organization_roles:
    - name: Organization Owner
      description: Complete administrative control of the organization and all its contents; inherits project Owner permissions for every project in the organization.
    - name: Organization Maintainer
      description: Can add and remove users in the organization; cannot view private projects they are not a member of and cannot add or remove organization Owners.
    - name: Organization Contributor
      description: Member of the organization with read and write access to projects based on project visibility and membership; no organization-level administration.
  project_roles:
    - name: Project Owner
      description: Complete administrative control over the project.
    - name: Project Writer
      description: Can create and edit resources (datasets, models, and similar) within the project.
    - name: Project Reader
      description: Can view all project contents but cannot make edits.
  permissions:
    - {resource: org, permission: org_read}
    - {resource: org, permission: add_owner}
    - {resource: org, permission: remove_owner}
    - {resource: org, permission: org_update_settings}
    - {resource: org, permission: add_user}
    - {resource: org, permission: remove_user}
    - {resource: org, permission: project_create}
    - {resource: project, permission: project_read}
    - {resource: project, permission: project_write}
    - {resource: project, permission: project_delete}
    - {resource: project, permission: project_update_settings}
    - {resource: project, permission: add_owner}
    - {resource: project, permission: remove_owner}
    - {resource: project, permission: add_user}
    - {resource: project, permission: remove_user}
    - {resource: project, permission: secret_write}
    - {resource: project, permission: secret_decrypt}
    - {resource: project, permission: secret_list}
    - {resource: project, permission: dataset_read}
    - {resource: project, permission: dataset_create}
    - {resource: project, permission: dataset_write}
    - {resource: project, permission: training_job_read}
    - {resource: project, permission: training_job_create}
    - {resource: project, permission: training_job_write}
    - {resource: project, permission: annotation_task_read}
    - {resource: project, permission: annotation_task_create}
    - {resource: project, permission: annotation_task_write}
    - {resource: project, permission: model_read}
    - {resource: project, permission: model_create}
    - {resource: project, permission: model_write}
    - {resource: project, permission: inference_server_read}
    - {resource: project, permission: inference_server_create}
    - {resource: project, permission: inference_server_write}
    - {resource: project, permission: workspace_read}
    - {resource: project, permission: workspace_create}
    - {resource: project, permission: workspace_write}
  visibility_modifiers: [public, restricted, internal, private]
x-evidence:
  - {fetched: '2026-08-05', url: 'https://production.chariot.striveworks.us/docs/user_guide/administration/authentication', http_status: 200}
  - {fetched: '2026-08-05', url: 'https://production.chariot.striveworks.us/docs/user_guide/administration/roles-permissions', http_status: 200}
  - {fetched: '2026-08-05', url: 'https://production.chariot.striveworks.us/api/identity/v2/users/me/', http_status: 401, body: '{"error":"invalid bearer token"}'}