Getting started with External APIs

This page shows you how to make your first authenticated API call to UiPath. It uses the client credentials flow with a confidential external application — the recommended starting point for production scripts, administrative automation, and integration work.

备注：

Choosing the right tool

The UiPath Swagger documentation lets you explore available API endpoints and understand request and response formats interactively in a browser. Use Swagger for discovery and manual testing only. For production automation, scripting, and integration, use Postman, cURL, or your application code — these support the full OAuth 2.0 bearer token flow required to authorize requests to UiPath APIs.

先决条件

• A UiPath organization administrator has registered a confidential external application with the Client Credentials grant type and assigned the required scopes to it.
• You have the App ID and App Secret for the registered application.

For information about registering external applications and choosing the right grant type, see External Applications (OAuth).

Step 1: Get a bearer token

Send a POST request to the Identity Server token endpoint to receive a bearer token.

curl -X POST "https://cloud.uipath.com/{organizationName}/identity_/connect/token" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "grant_type=client_credentials&client_id={app_id}&client_secret={app_secret}&scope={scopes}"

Replace the following placeholders:

占位符	值
{organizationName}	Your organization name as it appears in the Automation Cloud URL
{app_id}	The App ID from your external application registration
{app_secret}	The App Secret from your external application registration
{scopes}	Space-separated list of scopes granted to the application, for example: OR.Users.View PM.Users

The response returns a bearer token:

{
    "access_token": "{access_token}",
    "expires_in": 3600,
    "token_type": "Bearer",
    "scope": "{scopes}"
}

Copy the access_token value. The token is valid for one hour.

备注：

If you are using Postman or a similar tool, set the request content type to application/x-www-form-urlencoded.

Step 2: Call an API endpoint

Include the bearer token in the Authorization header of your API request.

The following example retrieves a list of machines from Orchestrator:

curl -X GET "https://cloud.uipath.com/{organizationName}/{tenantName}/orchestrator_/odata/Machines" \
  -H "Authorization: Bearer {access_token}" \
  -H "accept: application/json"

Replace {tenantName} with the name of your Orchestrator tenant and {access_token} with the token from Step 1.

结果

A successful request returns HTTP 200 with the requested data in JSON format.

If the request fails, verify the following:

• The token has not expired. Tokens expire after one hour — repeat Step 1 to request a new token.
• The Authorization header value is formatted exactly as Bearer {access_token}.
• The scopes granted to your external application cover the requested endpoint. To find the scope values for a specific endpoint, check that endpoint's documentation page in this guide, specifically under the Platform Management APIs chapter.

后续步骤

• For all OAuth grant types and flows — including Authorization Code and PKCE for user-delegated access — see External Applications (OAuth).
• For all Identity Server endpoints used in authentication, see UiPath Identity Server endpoints.
• To understand how to structure API endpoint URLs, see API endpoint URL structure.