Skip to main content

Service & Management Client API Reference

Manage your Pangea API Clients through the Access APIs

Base URL​

authorization.access.<csp>.<region>.pangea.cloud

get/.well-known/oauth-authorization-server
curl -sSLX GET 'https://authorization.access.aws.us.pangea.cloud/.well-known/oauth-authorization-server' \
-H 'Content-Type: application/json'

Response

Get OAuth Authorization Server Metadata

GET
https://authorization.access.aws.us.pangea.cloud/.well-known/oauth-authorization-server

Provides OAuth 2.0 Authorization Server metadata, including supported grant types, token endpoints, and other relevant discovery information.

object
string

The URL of the authorization server's issuer identifier.

string

The URL of the token endpoint.

array<string>

List of the supported response types.

string

Endpoint to revoke token endpoint

string

Endpoint to revoke token endpoint

array<string>

List of the supported authentication methods for the token endpoint.

array<string>

List of the supported grant types.

post/v1beta/oauth/token
curl -sSLX POST 'https://authorization.access.aws.us.pangea.cloud/v1beta/oauth/token' \
-H 'Authorization: Basic base64<clientId:clientSecret>' \
-H 'Content-Type: application/x-www-form-urlencoded'

Response

Get Access Token

POST
https://authorization.access.aws.us.pangea.cloud/v1beta/oauth/token

Exchanges valid client credentials (client_id and client_secret) for an access token using the client_credentials grant type.

string

The type of grant. Currently limited to 'client_credentials' support only.

string

An ID for a service account

An secret for an API Client

string

A list of space separated scopes. Examples include "scope": "pangea:service:ai-guard:read pangea:service:redact:read" for granting AI Guard & Redact API access. The actual service configurations the client has access to for those services is dictated through roles.

object
string

The access token issued by the authorization server.

string

The type of the token issued. Typically 'Bearer'.

integer

The lifetime in seconds of the access token.

post/v1beta/oauth/token/revoke
curl -sSLX POST 'https://authorization.access.aws.us.pangea.cloud/v1beta/oauth/token/revoke' \
-H 'Authorization: Basic base64<clientId:clientSecret>' \
-H 'Content-Type: application/x-www-form-urlencoded'

Response

Revoke Access Token

POST
https://authorization.access.aws.us.pangea.cloud/v1beta/oauth/token/revoke

Revokes a previously issued token, preventing any further use for protected resource access.

string

A token value

object
boolean

Indicates if the token was successfully revoked..

post/v1beta/oauth/token/introspect
curl -sSLX POST 'https://authorization.access.aws.us.pangea.cloud/v1beta/oauth/token/introspect' \
-H 'Authorization: Basic base64<clientId:clientSecret>' \
-H 'Content-Type: application/x-www-form-urlencoded'

Response

Introspect Access or Refresh Token

POST
https://authorization.access.aws.us.pangea.cloud/v1beta/oauth/token/introspect

Checks an access token or refresh token to determine if it is active, and retrieves additional metadata such as expiry and associated scopes.

string

Access token

string

A hint about the type of the token submitted for revocation.

object
boolean

Indicates whether the token is active

string

A space-separated list of scopes associated with this token

string

Client identifier for the OAuth 2.0 client that requested this token

string

Username of the resource owner who authorized this token

string

Type of the token, e.g., 'access_token'

integer

Timestamp when the token expires

integer

Timestamp when the token was issued

integer

Timestamp when the token is not to be used before

string

Subject of the token

array<string>

Audience for the token

string

Issuer of the token

string

JWT ID, a unique identifier for the token

post/v1beta/oauth/clients/register
curl -sSLX POST 'https://authorization.access.aws.us.pangea.cloud/v1beta/oauth/clients/register' \
-H 'Authorization: Bearer <your_token>' \
-H 'Content-Type: application/json' \
-d '{}'

Response

Create Platform Client

POST
https://authorization.access.aws.us.pangea.cloud/v1beta/oauth/clients/register

Registers a new OAuth client with the authorization server by specifying client information such as name, grant types, and scopes. Note that scopes define which API routes the client can access, while roles define object-level permissions. For example, a scope like 'pangea:service:ai-guard:read' may allow calling AI Guard endpoints, but the client also needs a corresponding role (e.g., 'type:service_ai_guard_config,role:manager') to be fully authorized. Both scopes and roles must be granted to ensure the client has complete access to the intended resources.

string
string

A list of space separated scopes. Examples include "scope": "pangea:service:ai-guard:read pangea:service:redact:read" for granting AI Guard & Redact API access. The actual service configurations the client has access to for those services is dictated through roles.

string

The authentication method for the token endpoint.

array<string>

A list of allowed redirect URIs for the client.

array<string>

A list of OAuth grant types that the client can use.

array,null<string,null>

A list of OAuth response types that the client can use.

integer, null

A positive time duration in seconds or null

integer, null

A positive time duration in seconds or null

string
string
array<object>

A list of roles. Roles are required to grant object access to clients, while client scopes dictate which API routes the clients may access. An example role: { "type": "service_ai_guard_config", "id": "pci_xxx", "role": "manager" }.

string

The specific role being assigned to a client. Examples include 'manager' for service configurations or 'admin' for projects.

string

The role resource type. Examples include 'organization', 'project', or 'service_{snake_case(service)}_config'.

The role resource id for the specified type. Examples include the id of an organization, project, or service_config.

object

API Client information with initial secret

string

An ID for a service account

string (date-time)

A time in ISO-8601 format

string (date-time)

A time in ISO-8601 format

string
string

A list of space separated scopes. Examples include "scope": "pangea:service:ai-guard:read pangea:service:redact:read" for granting AI Guard & Redact API access. The actual service configurations the client has access to for those services is dictated through roles.

string

The authentication method for the token endpoint.

array<string>

A list of allowed redirect URIs for the client.

array<string>

A list of OAuth grant types that the client can use.

array,null<string,null>

A list of OAuth response types that the client can use.

integer, null

A positive time duration in seconds or null

string
string

An secret for an API Client

string (date-time)

A time in ISO-8601 format

string
string
get/v1beta/oauth/clients
curl -sSLX GET 'https://authorization.access.aws.us.pangea.cloud/v1beta/oauth/clients' \
-H 'Authorization: Bearer <your_token>' \
-H 'Content-Type: application/json'

Response

List platform clients

GET
https://authorization.access.aws.us.pangea.cloud/v1beta/oauth/clients

Retrieves a paginated list of registered OAuth clients, with optional filters for name, client_id, and creation or update time.

string (date-time)
string (date-time)
string (date-time)
string (date-time)
string (date-time)
string
array<string>
array<string>
string
array<string>
array<string>
array<string>
string (date-time)
string (date-time)
string (date-time)
string (date-time)
string (date-time)
string
string
string
integer
  • minimum: 1

get/v1beta/oauth/clients/{id}
curl -sSLX GET 'https://authorization.access.aws.us.pangea.cloud/v1beta/oauth/clients/{id}' \
-H 'Authorization: Bearer <your_token>' \
-H 'Content-Type: application/json'

Response

Get Platform Client

GET
https://authorization.access.aws.us.pangea.cloud/v1beta/oauth/clients/{id}

Fetches detailed information about a specific OAuth client by its unique identifier.

string

object

API Client information

string

An ID for a service account

string (date-time)

A time in ISO-8601 format

string (date-time)

A time in ISO-8601 format

string
string

A list of space separated scopes. Examples include "scope": "pangea:service:ai-guard:read pangea:service:redact:read" for granting AI Guard & Redact API access. The actual service configurations the client has access to for those services is dictated through roles.

string

The authentication method for the token endpoint.

array<string>

A list of allowed redirect URIs for the client.

array<string>

A list of OAuth grant types that the client can use.

array,null<string,null>

A list of OAuth response types that the client can use.

integer, null

A positive time duration in seconds or null

string
string
post/v1beta/oauth/clients/{id}
curl -sSLX POST 'https://authorization.access.aws.us.pangea.cloud/v1beta/oauth/clients/{id}' \
-H 'Authorization: Bearer <your_token>' \
-H 'Content-Type: application/json' \
-d '{}'

Response

Update Platform Client

POST
https://authorization.access.aws.us.pangea.cloud/v1beta/oauth/clients/{id}

Updates an existing OAuth client's configuration, such as grant types, redirect URIs, or scope.

string

string

An ID for a service account

string

A list of space separated scopes. Examples include "scope": "pangea:service:ai-guard:read pangea:service:redact:read" for granting AI Guard & Redact API access. The actual service configurations the client has access to for those services is dictated through roles.

string
string

The authentication method for the token endpoint.

array<string>

A list of allowed redirect URIs for the client.

array,null<string,null>

A list of OAuth response types that the client can use.

array<string>

A list of OAuth grant types that the client can use.

object

API Client information

string

An ID for a service account

string (date-time)

A time in ISO-8601 format

string (date-time)

A time in ISO-8601 format

string
string

A list of space separated scopes. Examples include "scope": "pangea:service:ai-guard:read pangea:service:redact:read" for granting AI Guard & Redact API access. The actual service configurations the client has access to for those services is dictated through roles.

string

The authentication method for the token endpoint.

array<string>

A list of allowed redirect URIs for the client.

array<string>

A list of OAuth grant types that the client can use.

array,null<string,null>

A list of OAuth response types that the client can use.

integer, null

A positive time duration in seconds or null

string
string
delete/v1beta/oauth/clients/{id}
curl -sSLX DELETE 'https://authorization.access.aws.us.pangea.cloud/v1beta/oauth/clients/{id}' \
-H 'Authorization: Bearer <your_token>' \
-H 'Content-Type: application/json'

Response

No content

Delete Platform Client

DELETE
https://authorization.access.aws.us.pangea.cloud/v1beta/oauth/clients/{id}

Removes an OAuth client and invalidates any tokens issued to it.

string
post/v1beta/oauth/clients/{id}/secrets
curl -sSLX POST 'https://authorization.access.aws.us.pangea.cloud/v1beta/oauth/clients/{id}/secrets' \
-H 'Authorization: Bearer <your_token>' \
-H 'Content-Type: application/json' \
-d '{}'

Response

Create Client Secret

POST
https://authorization.access.aws.us.pangea.cloud/v1beta/oauth/clients/{id}/secrets

Generates and returns a new client secret for an existing OAuth client, typically used for client authentication.

string

integer

A positive time duration in seconds

  • exclusiveMinimum: 0
string
string

object
string

An ID for a service account

string

An ID for an API Client secret

An secret for an API Client

string (date-time)

A time in ISO-8601 format

string
string
get/v1beta/oauth/clients/{id}/secrets/metadata
curl -sSLX GET 'https://authorization.access.aws.us.pangea.cloud/v1beta/oauth/clients/{id}/secrets/metadata' \
-H 'Authorization: Bearer <your_token>' \
-H 'Content-Type: application/json'

Response

List Client Secret Metadata

GET
https://authorization.access.aws.us.pangea.cloud/v1beta/oauth/clients/{id}/secrets/metadata

Retrieves metadata for all secrets associated with the specified OAuth client, including creation time, name, and expiration.

string

string (date-time)
string (date-time)
string (date-time)
string (date-time)
string (date-time)
string
array<string>
array<string>
string
string
string
integer
  • minimum: 1

delete/v1beta/oauth/clients/{id}/secrets/{client_secret_id}
curl -sSLX DELETE 'https://authorization.access.aws.us.pangea.cloud/v1beta/oauth/clients/{id}/secrets/{client_secret_id}' \
-H 'Authorization: Bearer <your_token>' \
-H 'Content-Type: application/json'

Response

No content

Revoke Client Secret

DELETE
https://authorization.access.aws.us.pangea.cloud/v1beta/oauth/clients/{id}/secrets/{client_secret_id}

Invalidates a specific client secret, preventing its further use for token requests.

string
string
post/v1beta/oauth/clients/{id}/secrets/{client_secret_id}
curl -sSLX POST 'https://authorization.access.aws.us.pangea.cloud/v1beta/oauth/clients/{id}/secrets/{client_secret_id}' \
-H 'Authorization: Bearer <your_token>' \
-H 'Content-Type: application/json' \
-d '{}'

Response

Update Client Secret

POST
https://authorization.access.aws.us.pangea.cloud/v1beta/oauth/clients/{id}/secrets/{client_secret_id}

Modifies metadata for an existing client secret, such as its expiration or descriptive fields.

string
string

integer

A positive time duration in seconds

  • exclusiveMinimum: 0
string
string

object
string

An ID for a service account

string

An ID for an API Client secret

An secret for an API Client

string (date-time)

A time in ISO-8601 format

string
string
get/v1beta/oauth/clients/{id}/roles
curl -sSLX GET 'https://authorization.access.aws.us.pangea.cloud/v1beta/oauth/clients/{id}/roles' \
-H 'Authorization: Bearer <your_token>' \
-H 'Content-Type: application/json'

Response

List Client Roles

GET
https://authorization.access.aws.us.pangea.cloud/v1beta/oauth/clients/{id}/roles

Retrieves roles currently assigned to a particular OAuth client, optionally filtered by resource type or role name.

string

string
string
string

post/v1beta/oauth/clients/{id}/grant
curl -sSLX POST 'https://authorization.access.aws.us.pangea.cloud/v1beta/oauth/clients/{id}/grant' \
-H 'Authorization: Bearer <your_token>' \
-H 'Content-Type: application/json' \
-d '{}'

Response

Grant Client Access

POST
https://authorization.access.aws.us.pangea.cloud/v1beta/oauth/clients/{id}/grant

Assigns or updates roles and scopes to extend the client’s permissions for accessing specific resources or operations.

string

array<object>

A list of roles. Roles are required to grant object access to clients, while client scopes dictate which API routes the clients may access. An example role: { "type": "service_ai_guard_config", "id": "pci_xxx", "role": "manager" }.

string

The specific role being assigned to a client. Examples include 'manager' for service configurations or 'admin' for projects.

string

The role resource type. Examples include 'organization', 'project', or 'service_{snake_case(service)}_config'.

The role resource id for the specified type. Examples include the id of an organization, project, or service_config.

string

A list of space separated scopes. Examples include "scope": "pangea:service:ai-guard:read pangea:service:redact:read" for granting AI Guard & Redact API access. The actual service configurations the client has access to for those services is dictated through roles.

object
post/v1beta/oauth/clients/{id}/revoke
curl -sSLX POST 'https://authorization.access.aws.us.pangea.cloud/v1beta/oauth/clients/{id}/revoke' \
-H 'Authorization: Bearer <your_token>' \
-H 'Content-Type: application/json' \
-d '{}'

Response

Revoke Client Access

POST
https://authorization.access.aws.us.pangea.cloud/v1beta/oauth/clients/{id}/revoke

Removes previously assigned roles or scopes from the specified OAuth client, reducing or revoking its permissions.

string

array<object>

A list of roles. Roles are required to grant object access to clients, while client scopes dictate which API routes the clients may access. An example role: { "type": "service_ai_guard_config", "id": "pci_xxx", "role": "manager" }.

string

The specific role being assigned to a client. Examples include 'manager' for service configurations or 'admin' for projects.

string

The role resource type. Examples include 'organization', 'project', or 'service_{snake_case(service)}_config'.

The role resource id for the specified type. Examples include the id of an organization, project, or service_config.

string

A list of space separated scopes. Examples include "scope": "pangea:service:ai-guard:read pangea:service:redact:read" for granting AI Guard & Redact API access. The actual service configurations the client has access to for those services is dictated through roles.

object
Status Codes​

Was this article helpful?

Contact us