Authentication to the First AML API is via OAuth2/OpenID. Currently only the client credentials flow is supported, but we may introduce support for other OAuth2 flows in the future. OAuth2 works by allowing an API client to make a request to a token endpoint, to exchange credentials for a short-lived token (known as a bearer token) which is then used to secure each subsequent request to the API.
You create your own API clients from within the First AML Platform, under Settings > Integrations > API Credentials. The credentials consist of a Client ID and Client Secret, and from that page you can view the credentials of your existing API clients, or delete an API client you no longer need. See Account Setup for more detail.
Scopes
All operations performed in the API will check to ensure:
- The API client has access to the organization’s data.
- The API client has the necessary scope (permission) to perform the operation.
Currently the Public API has two scopes available for securing API requests. When setting up an API client you can elect to provision the client with one or more of the following scopes:
| Name | Description |
|---|---|
| case-management | Scope created to call any case related mutation (update). |
| read-only | Scope required to be able to retrieve any information about a case. |
| api-management | Scope required to be able to manage aspects of API usage such as webhook creation. |
You can view which scopes are required for specific queries and mutations in the schema browser.
In the future we will introduce more granular scopes (the above scopes will remain available) to allow further restriction to what an API client is able to do, to ensure customers can build integrations from a 'least privilege' perspective.
