generated: '2026-08-06'
method: searched
source: openapi/apriori-ap-connect-agent.yml
docs:
- https://docs.apriori.com/en/Connect/apc/rarg/Security/
- https://docs.apriori.com/en/Connect/apc/sag/REST-API-Management-Responsibilities/
- https://docs.apriori.com/en/Connect/apc/rn/release-notes/
- https://www.apriori.com/security/
api: aP Connect Agent REST API
summary:
  types:
  - apiKey
  api_key_in:
  - header
  - query
  oauth2: false
  openid_connect: false
  mutual_tls: true
  mutual_tls_scope: transport, configured on the Connector — not selectable per request
schemes:
- name: JWTBearer
  label: JWT Bearer
  type: apiKey
  in: header
  parameter: Authorization
  description: >-
    Published by aPriori as security scheme "JWT Bearer" — type apiKey, name Authorization, in HEADER.
    Note that aPriori declares this as an apiKey scheme rather than as HTTP bearer, so no bearerFormat is
    published and no token endpoint, issuer or expiry policy is documented.
  applies_to: all 12 operations
  sources:
  - openapi/apriori-ap-connect-agent.yml
  - https://docs.apriori.com/en/Connect/apc/rarg/Security/
- name: SharedSecret
  label: Shared Secret
  type: apiKey
  in: query
  parameter: key
  description: >-
    Published by aPriori as security scheme "Shared Secret" — type apiKey, name key, in QUERY.
  applies_to: all 12 operations
  risk: >-
    A credential carried in the query string is written to proxy, load-balancer and web-server access logs
    and can leak via Referer headers. Prefer the JWT Bearer header where the deployment allows it.
  sources:
  - openapi/apriori-ap-connect-agent.yml
  - https://docs.apriori.com/en/Connect/apc/rarg/Security/
transport_security:
  mtls:
    supported: true
    since: '2026-06-30'
    requires: aP Connect Agent 5.2.0 or later
    configuration: >-
      Enable the mTLS option when creating the Connector, then supply the aPriori-signed certificate during
      Agent installation. The certificate must be obtained from aPriori Support before install.
    install_modes:
      supported: [Setup Wizard, console (-c)]
      unsupported: [unattended (-q)]
    replaces: IP allowlisting of the Agent host
    rationale_published: >-
      "This is increasingly important for organizations who may be unable to guarantee static IP addresses."
    source: https://docs.apriori.com/en/Connect/apc/rn/release-notes/
  certificates:
    jdk_import_required: true
    note: >-
      aPriori documents importing Java Developer Kit certificates and obtaining a signed certificate as part
      of Agent installation.
    source: https://docs.apriori.com/en/Connect/apc/ig/Importing-Java-Developer-Kit-Certificates/
application_sso:
  scope: aPriori Cloud application sign-in — NOT the API
  provider: Auth0
  detail: >-
    aPriori's security page states that single sign-on runs through a dedicated Auth0 production tenant with
    SAML integration to customer identity providers. This governs human login to aPriori Cloud
    (https://cloud.apriori.net/), not machine access to the Agent API.
  source: https://www.apriori.com/security/
  instructions: https://www.apriori.com/sso-instructions-page/
not_published:
- No OAuth 2.0 flow, authorization server, token endpoint or scope model for the API.
- No /.well-known/openid-configuration or /.well-known/oauth-authorization-server on any host (probed; see well-known/apriori-well-known.yml).
- No key rotation, expiry or revocation policy for the JWT or the shared secret.
- No self-serve credential issuance. Access to the API follows a paid deployment; aPriori recommends an aPriori System Services engagement for leveraging it on a file-system deployment.
x-evidence:
  fetched: '2026-08-06'
  sources:
  - url: https://docs.apriori.com/en/Connect/apc/rarg/Security/
    http_status: 200
  - url: https://docs.apriori.com/en/Connect/apc/sag/REST-API-Management-Responsibilities/
    http_status: 200
  - url: https://docs.apriori.com/en/Connect/apc/rn/release-notes/
    http_status: 200
  - url: https://www.apriori.com/security/
    http_status: 200