generated: '2026-07-17'
method: searched
source: https://github.com/appaegis/api-script-samples/blob/main/lib/common.py
docs: https://github.com/appaegis/api-script-samples#prerequisite
summary:
  types: [apiKey, http]
  api_key_in: [header]
  http_schemes: [bearer]
  model: token-exchange
  note: >-
    No published OpenAPI/OIDC discovery document is available; this profile is
    derived from the provider's public api-script-samples repository (lib/common.py)
    and README, which document the real authentication flow verbatim.
flow:
  description: >-
    Two-step token-exchange. An API key (apiKey) and secret (apiSecret) are issued
    in the Mammoth Cyber management portal under "Setting -> Admins & API Keys ->
    API Keys" (the secret is displayed once and can be downloaded as a dotenv file).
    The client POSTs the apiKey/apiSecret pair to the authentication endpoint and
    receives a short-lived idToken, which is then presented on subsequent calls.
  token_exchange:
    method: POST
    url: https://api.mammothcyber.net/api/v2/authentication
    request_content_type: application/json
    request_body: '{ "apiKey": "...", "apiSecret": "..." }'
    response_field: Authorization
    returns: idToken (JWT)
  presenting_the_token:
    - surface: REST (v1 + v2)
      header: idToken
      value: <idToken>
    - surface: GraphQL (/graphql, /api/graphql)
      header: Authorization
      value: Bearer <idToken>
schemes:
  - name: apiKeySecret
    type: apiKey
    in: header
    description: >-
      apiKey + apiSecret credential pair exchanged at /api/v2/authentication for an
      idToken. Created and revoked in the management portal.
    sources: [https://github.com/appaegis/api-script-samples/blob/main/lib/common.py]
  - name: idTokenHeader
    type: apiKey
    in: header
    parameter_name: idToken
    description: Short-lived idToken presented on REST v1/v2 requests.
    sources: [https://github.com/appaegis/api-script-samples/blob/main/lib/common.py]
  - name: bearerAuth
    type: http
    scheme: bearer
    bearer_format: JWT
    description: Same idToken presented as a Bearer token on the GraphQL endpoint.
    sources: [https://github.com/appaegis/api-script-samples/blob/main/block-list-pac-v2.py]