API clients

An API client lets a third-party system access your tenant and its services through the Acronis APIs, so that you can integrate that system with your tenant.

In Cyber Console, the API clients screen is under Settings > General settings > API clients. By default, the screen shows the API clients of your own tenant. When you select a client in the tenant selector, the screen shows the API clients of that client, and the API clients that you create belong to that client.

An API client is either Active or Disabled. If the creator cannot be determined, Created by shows Parent tenant administrator.

If you select a tenant that is in self-service management mode or in which support access is disabled, the list shows API clients cannot be managed for this tenant because it is in self-service management mode or support access is disabled. If the list cannot be loaded for another reason, an error message appears instead of the list.

How an API client works

An API client is a special platform account that represents the third-party system. API clients are part of the OAuth 2.0 authorization framework of the Acronis platform.

The third-party system uses an API client as follows:

  1. An administrator creates the API client.

  2. An administrator enables the OAuth 2.0 client credentials flow in the third-party system.

  3. Before the third-party system accesses the tenant through the API, it sends the credentials of the API client to the platform through the authorization API.

  4. The Acronis platform returns a security token, a unique string that is assigned to this API client.

  5. The third-party system adds the token to every API request, instead of the credentials.

The security token expires in two hours. After that, API requests with the expired token fail, and the third-party system must request a new token.

Credentials

The credentials of an API client consist of a unique identifier (ID) and a secret value. The credentials do not expire. You cannot use them to log in to Cyber Console or to any other console. You cannot enable two-factor authentication for an API client.

The secret value is shown only once, when you create the API client or reset its secret. If you lose it, you cannot retrieve it, but you can reset it.

Access

An API client can access only the tenant in which it is created, and the child tenants of that tenant.

An API client has no roles that you can assign. It acts as an administrator in the tenants that it can access.