Authorizing API Calls in Swagger

Accessing Swagger

If you are using Swagger to try our API, just log in to your Orchestrator instance in a separate tab.

The Orchestrator API Swagger definition can be accessed by adding the /swagger/ui/index#/ suffix to your Orchestrator URL. For example, https://{yourDomain}/{organizationName}/{tenantName}/orchestrator_ /swagger/ui/index#/.

Note: The Swagger authentication expires according to the parameters set in your Orchestrator instance. By default, it is set to 30 minutes. You can change it by modifying the value of the Auth.Cookie.Expire parameter, in the Web.config file.

Obtaining an Access Token

To authorize API calls via the Swagger UI for Orchestrator services, perform the following steps:

1. Look for the Authorize button at the top right corner of the Orchestrator API page. If the lock is open, you are unauthorized.

   
   

   

   
   

2. Click Authorize. The Available authorizations window is displayed.

   Note: We currently support one authorization scheme called OAuth2.
   
   

   

   
   
3. All scopes are preselected such that you can experiment with all endpoints in the Orchestrator API. Clear them if you want to restrict access to certain APIs.
4. Click Authorize. A new window is displayed confirming you have been authorized.
5. Once done, click Close or X to close the Available authorizations window. The Authorize button shows an closed lock meaning you are authorized.

Sending Requests

While authorized, you can make requests on Orchestrator API resources as follows:

1. Expand an Orchestrator API resource with which you want to perform an operation. The closed lock means that you’re authorized.
   
   

   

   
   
2. In the expanded method window, click Try it out.
3. Specify parameter values if required.
4. Click Execute. The request is executed. A bearer authorization header is automatically used for your requests.
   
   

   

   
   

Generating a New Access Token

When the access token expires you receive a 401: You are not authenticated! response. The bearer authorization header is still present for your requests, but the access token is expired. When this happens, you need to invalidate the expired token and generate a new access token:

1. Look for the Authorize button at the top right corner of the Orchestrator API page. The lock should be closed.
   
   

   

   
   
2. Click Authorize and on the displayed Available authorizations page, click Logout to revoke the expired token.
   
   

   

   
   
3. Close the Available authorizations window by clicking Close or X and then obtain an access token as described on the Obtaining an access token section.

Revoking Access

When you're done working with the Swagger UI, you should invalidate the access token you've used:

1. Look for the Authorize button at the top right corner of the Orchestrator API page. The lock should be closed, meaning you are authorized.
2. Click Authorize and on the displayed Available authorizations page, click Logout.
3. Close the Available authorizations window by clicking Close or X. The Authorize button shows an open lock meaning you are unauthorized.