Authenticate

Authenticate to the API

AZExecute uses Microsoft Entra OAuth 2.0 bearer tokens. Choose a delegated flow when a person is acting interactively, or client credentials when an application or automation identity acts without a signed-in user.

• Delegated clients request https://api.azexecute.com/Standard.Access.

• Service principals request https://api.azexecute.com/.default and must have an assigned API app role.

• Send the resulting token as Authorization: Bearer <access-token>.

• Acquire a new token after changing app-role assignments; existing tokens retain their original claims until renewed.

After authentication, use API Swagger to inspect the supported operations, required roles, request bodies, and response schemas for the deployed API version.

Azure CLI - Delegated User Token

Use this flow to obtain a delegated user token with the API scope configured for AZExecute.

A user's effective tenant role is resolved when the token is processed. After changing an Entra app-role assignment, acquire a fresh token; an existing access token can continue to contain the previous role until it is renewed.

Client Credentials Flow with PowerShell

Use this flow when authenticating as a service principal that has been assigned an API access role.

1. Create or select a Microsoft Entra app registration for the client.

2. Assign its enterprise application the minimum required AZExecute API app role: User, Operator, or TenantAdmin.

3. Configure a client secret, certificate, federated credential, or managed identity credential appropriate for your environment.

4. Request a token from the tenant-specific token endpoint using the .default scope.

The sample uses a client secret for readability. Prefer a certificate, workload identity federation, or managed identity when your hosting platform supports it. Never place credentials in source control.

Common Authentication Errors

• 401 Unauthorized: the token is missing, expired, malformed, or issued for the wrong audience.

• 403 Forbidden: authentication succeeded, but the identity lacks the required API role or access to the requested resource.

• Role change not visible: obtain a fresh token and verify its roles claim.

• Client credentials rejected: verify the tenant ID, client ID, credential, .default scope, and enterprise-application role assignment.

Authorization Code Flow for Web Apps

This flow is used for web applications where a user needs to log in interactively.

Device Code Flow

This flow is useful when logging in on a device without a browser.