REST API Authentication
When you expose an integration as a REST API in Adeptia, you control who can call it and how callers prove their identity. REST API authentication lets you protect each API endpoint with a security policy, ensuring that only authorized clients can trigger your integration flows.
Why authentication matters for your integrations
Every REST API you publish through Adeptia can carry sensitive business data or trigger critical process flows. Requiring callers to authenticate before the platform processes a request prevents unauthorized access and gives you a clear, auditable boundary between your integration logic and the outside world.
Authentication types
Adeptia supports three authentication types for REST APIs. You choose one when you configure the security policy for your API endpoint.
| Authentication type | How it works |
|---|---|
| Basic | The caller supplies a username and password. The platform validates the credentials before allowing the request to proceed. |
| API Key | The caller presents an API key. The platform verifies the key and, optionally, checks that required claim parameters are present within it. |
| Kerberos | The caller authenticates using a Kerberos ticket. The platform validates the ticket through the configured login module. |
Basic authentication: credential sources
When you use Basic authentication, you also choose where the platform looks up and validates the supplied credentials. Three options are available:
| Credential source | Description |
|---|---|
| Fixed username and password | The platform compares the caller's credentials against a specific username and password you define directly in the security policy. |
| Platform user | The platform validates the caller against an active user account stored in the platform's own user directory. You can also restrict access to callers who belong to specific user groups or roles. |
| LDAP user | The platform validates the caller against your organization's LDAP directory. You can restrict access to callers who belong to specific LDAP groups. |
API Key authentication
With API Key authentication, the caller includes a key in the request. You configure whether the key is expected in a request header or as a query parameter. You can also specify claim parameters that must be present inside the key's payload; if any required claim is missing, the platform rejects the request.
Kerberos authentication
Kerberos authentication delegates credential validation to a Kerberos-compatible login module that you specify in the security policy. The caller must present a valid Kerberos negotiation token; if the token is absent or invalid, the platform denies the request.
How authentication fits into your API setup
Authentication is configured as part of the security policy you attach to a REST API provider. When a request arrives, the platform checks the security policy to determine which authentication type applies, then validates the caller's credentials accordingly. Only after successful authentication does the platform route the request to the associated integration flow.
Group and role-based access control
For Basic authentication backed by the platform user directory or LDAP, you can go beyond simple credential checking by restricting access to callers who belong to designated groups or roles. This means you can publish the same API endpoint while ensuring that only users with the right organizational membership can invoke it.
Session-based access
In addition to the credential-based methods above, the platform can recognize callers who are already signed in to the Adeptia portal. When this capability is enabled, a valid session token carried by the request is used to identify the caller, and the platform confirms that the associated user has permission to execute process flows before proceeding.