> For AI agents: [llms.txt](https://docs.trustedauth.com/llms.txt) provides a Markdown index of this documentation.

# Integrate Administration API

Use the IDaaS Administration REST API to perform administrative actions on users and authenticators without signing in to the Administrator Portal. IDaaS provides a JSON credentials file that your integration uses for authentication.

See the [Administration API documentation](/api/admin-api/getting-started.md) for more information.

## Step 1: Add an Administration API and configure the General settings

To create an Administration API application, complete the following steps.

1. Click Menu icon **>** **Security > Applications**. The **Applications** page appears.

2. Click **+**. The **Select an Application Template** page appears.

3. Do one of the following:

   - Select the **IDaaS Integrations** button and scroll to find the application you want to add to IDaaS.
   - In the **Search bar**, enter a search option to filter for the application you want to add to IDaaS.

4. Click **Administration API**. The **Add Administration API** page appears.

5. In the **Application Name** field, type a name for your application.

6. In the **Application Description** field, enter a description for your application.

7. From the **Select Role** drop-down list, select the role to assign to the API application. The role defines the operations that the API application can perform. You can select an Identity as a Service system-defined role or a custom role. You cannot select **No Role Assigned**.

   System-defined roles include:

   - **Auditor.** This role grants view-only access to users, authenticators, roles, and tokens on the integrated Identity as a Service account.
   - **Help Desk Administrators.** This role allows you to add or remove users and their authenticators.
   - **SIEM Add-on**: This role provides full access to all SIEM management functions in view-only mode.
   - **Super Administrator.** This role allows you to add or remove users and their authenticators, and query your Identity as a Service account roles.
   - **SCIM Provisioning.** This role allows the SCIM provisioning application to perform resource provisioning using SCIM protocols.
   - **On-boarding Administrator.** This role allows a user assigned this role to manage Tenant accounts. Only for Service Provider super account managers can select this role. If you are not a Service Provider super account manager, this option is not visible.
   - **AD Connector.** This role allows the AD Connector application to perform AD Connector directory synchronization.

8. If required, from the **Select IP List** drop-down list, select the IP List to restrict user access only to IP addresses included in the IP List. The default is **None** to allow access for all IP addresses.

9. Select **Allow this application to use a long-lived token for authentication**. This generates a long-lived token (one that does not expire) for API requests.

10. Click **Save**. The **Application Credentials** dialog box appears.

11. Do one of the following:

    - Click **Copy to Clipboard** to copy the **applicationId**, **hostname**, and **sharedSecret**. You need these values to set up your Administration API.
    - Click **Download** to download a JSON file that contains the API credentials for this application.

12. Click **OK**.

13. Proceed to [Step 2: Configure a resource rule](#step-2-configure-a-resource-rule).

## Step 2: Configure a resource rule

1. Click the **Resource Rules** tab.
2. Click **Add Resource Rule**.
3. Follow the instructions in [Create and manage resource rules](/docs/authentication-and-security/create-and-manage-resource-rules/create-resource-rules.md).