Authentication

All Engine API calls require a Bearer token obtained from the Identity API.

POST /connect/token

Exchanges client credentials for an access token.

Headers:

Content-Type: application/x-www-form-urlencoded

Body:

Field	Required	Description
grant_type	Yes	Must be client_credentials.
client_id	Yes	API client identifier from the portal.
client_secret	Yes	API client secret from the portal.

Example:

curl -X POST "$KUSTODYAN_IDENTITY_URL/connect/token" \
  -d "grant_type=client_credentials" \
  -d "client_id=$KUSTODYAN_CLIENT_ID" \
  -d "client_secret=$KUSTODYAN_CLIENT_SECRET"

Response (200):

{
  "access_token": "eyJ...",
  "expires_in": 1800,
  "token_type": "Bearer",
  "scope": "rps_engine_api"
}

Tokens are short-lived. They last 30 minutes by default (expires_in is 1800 seconds). Always send them in the Authorization: Bearer <token> header on Engine API calls.

TIP

Cache the token in your application rather than requesting a new one on every call, which wastes Identity API capacity. Refresh it proactively shortly before it expires; a timer-driven refresh avoids thundering-herd behavior when many callers' tokens expire at once.

Client scoping

API clients issued from the portal can be either Global or context-scoped.

A Global client is usable across all rights contexts, processing contexts, and secrets managers in the configuration.

A context-scoped client is limited to specified rights contexts, processing contexts, or secrets managers. Use context-scoped clients when an integration only needs a narrow set of operations, for example a protect-only client that can write protected values but cannot unprotect them to see the cleartext.