API Token Authentication

[DocsTeam]

From the Authentication Type drop-down list, select API Token.

In the Base URL field, enter the base URL to connect to the target managed system.

---

This is the companion discussion topic for the documentation at https://documentation.sailpoint.com/connectors/webservices/help/integrating_webservices/api_token_authentication.html

[mdewallnc (Matt D)]

How to use this token?

$application.apitoken$

???

[ryan_mccall]

Hi Matt! Thank you for your input. Can you provide more information to help our team understand how to best address it? Specifically, do you need more information on what the API Token field is used for or how to use that specific token?

[mdewallnc (Matt D)]

Hi Ryan, thanks for quick response. Seems related to this person’s thread:

WebService source fails when using accesstoken variable in HTTP Operations header

Hi @dmcconnell_epsilon, I don’t see any direct issues based on the description you posted. But here are few things I would try to get better insights on what went wrong, You can take a look at the VA log and revise the log level to print everything (DEBUG/TRACE) to see if it prints the entire request for further debugging. Try the curl alternative which practically does the same thing, curl --location --request POST '<Your_endpoint>' \ --header 'x-api-key: $application.accesstoken$' \ --hea…

The documentation I’m citing, it doesn’t say how the API key it can be used, I think that would be helpful.

Later in the documentation, it does hint at how some of these tokens are used (HTTP Header Section) but there some other secrets are referenced, not the API token.

On top of everything, it doesn’t actually work (I had to use the cert secret password like the last poster mentioned), which makes it really frustrating, because even if you found the right name for that variable in the docs somewhere, it doesn’t actually work. So it seems to be compound issue of missing documentation and a bug on top of it.

At least on the page I’m mentioned, it should be stated somewhere, "this can be referenced in later connection setups as $application.whatever$, which can be placed into HTTP Headers, POST bodies, etc.

[ryan_mccall]

Hi Matt, thanks for the additional information. I’ve created CON-DOCS 4162 to track this change on our end. We’ll look into adding some additional information on this page around the API token variable and how/where it can be used.

[joshb488 (Joshua Bergeron)]

Hi Matt! The work for CONDOCS-4162 has been completed, and the topic now contains more information about API token placeholders, as well as links to other parts of the guide with supporting information. I hope this helps.
-Josh