Skip to content
IT Canvass
Menu
ServiceNow
SailPoint
SAP
TutorialsContact
APIs & integration · Lesson

Authentication

Quick answer

API calls authenticate with OAuth: obtain an access token, then send it as an Authorization bearer header on every request.

Key takeaways

  • Obtain a token via OAuth
  • Send Authorization: Bearer <token>
  • Tokens expire and must be refreshed
  • Use least-privilege scopes

Authenticating API calls to SailPoint means obtaining an OAuth access token and sending it as a bearer header on every request. Without a valid token the API rejects the call; with one, the token’s scopes determine what the call may do. This page covers the practical mechanics.

The basic pattern

  • 1. Obtain a token from the OAuth token endpoint using client credentials.
  • 2. Send it on each request: Authorization: Bearer <token>.
  • 3. Refresh when it nears expiry; re-authenticate on 401.
# 1. get token, then 2. call with it
curl -H "Authorization: Bearer $TOKEN" \
  "https://tenant.api.identitynow.com/v3/accounts?limit=50"

What happens without a token

A missing or invalid token returns 401 Unauthorized. A valid token with insufficient scope returns 403 Forbidden. Distinguishing the two is the first step in debugging access problems: 401 means "who are you?", 403 means "you may not do that".

Token lifecycle in code

Robust clients acquire a token once, cache it, and transparently refresh it shortly before expiry, retrying a single time on an unexpected 401. Hard-coding a token or fetching a fresh one on every call are both anti-patterns, the former breaks on rotation, the latter wastes calls and invites rate limiting.

Common pitfalls

  • Confusing 401 and 403, wasting time on the wrong cause.
  • No refresh handling, so long-running jobs fail when the token expires.
  • Credentials in source control.

Want to learn this properly?

Our live, instructor-led SailPoint Training covers this hands-on, with real projects and a certification path.

See the courseAsk a question

Check your understanding

  1. How are API calls authenticated?

    • A. Refresh the token and retry on 401.
    • B. The API returns 401 Unauthorized.
    • C. With an OAuth access token sent as an Authorization bearer header.
    Show answer

    C. With an OAuth access token sent as an Authorization bearer header.

    With an OAuth access token sent as an Authorization bearer header.

  2. What happens without a valid token?

    • A. With an OAuth access token sent as an Authorization bearer header.
    • B. The API returns 401 Unauthorized.
    • C. Refresh the token and retry on 401.
    Show answer

    B. The API returns 401 Unauthorized.

    The API returns 401 Unauthorized.

  3. How do you handle expiry?

    • A. The API returns 401 Unauthorized.
    • B. With an OAuth access token sent as an Authorization bearer header.
    • C. Refresh the token and retry on 401.
    Show answer

    C. Refresh the token and retry on 401.

    Refresh the token and retry on 401.

Frequently asked questions

What else is worth knowing about Authentication?

A valid token with insufficient scope returns 403 Forbidden.

What is the practical takeaway on Authentication?

Robust clients acquire a token once, cache it, and transparently refresh it shortly before expiry, retrying a single time on an unexpected 401.

What tends to go wrong with API authentication?

Confusing 401 and 403, wasting time on the wrong cause. No refresh handling, so long-running jobs fail when the token expires. Credentials in source control.
CallWhatsAppEnquire