Skip to main content

Authentication and authorization

Use this page to understand how Administration API authentication works before you call protected endpoints. For complete operation details, see the Administration API reference.

Authentication​

The Administration API uses an API key security scheme in the Authorization header. Authenticate the Admin API application before making other requests, then use the returned token in each protected request.

The authentication response includes the token creation and expiration times:

{
  "authToken": "<admin-api-auth-token>",
  "expirationTime": "2026-08-14T19:07:50.328+0000",
  "creationTime": "2026-08-14T18:52:50.329+0000"
}

The raw HTTP examples in REST examples show how to send the Authorization header.

Reauthenticate after token expiry

An expired authentication token returns HTTP 401 Unauthorized. Obtain a new token before retrying the protected request. Applications can track expirationTime and reauthenticate before the token expires.

Optional web session cookie

When the authentication request enables a web session, IDaaS also returns an INTELLITRUST_SESSION_ID cookie. Include both this cookie and the authentication token in subsequent Administration API requests.

Contact​

For help with Entrust Identity as a Service Administration API integrations, contact support@entrust.com or visit Entrust.

Next steps​