generated: '2026-08-19'
method: searched
source: https://developer.cisco.com/docs/support-apis/authentication/
docs: https://developer.cisco.com/docs/support-apis/authentication/
description: >-
  Every Cisco Support API request is authenticated with an OAuth 2.0 client
  credentials bearer token minted at Cisco Common Identity (id.cisco.com). There is
  no API-key or basic-auth path, and no end-user authorization step — the token
  carries the identity, role and customer-data permissions of the API user who
  registered the application in the Cisco API Console. Captured from Cisco's own
  authentication and application-registration pages, and cross-checked against the
  live authorization-server metadata saved in well-known/.
base_hosts:
  - https://apix.cisco.com
  - https://api.cisco.com
security_schemes:
  - id: cisco_oauth2_client_credentials
    type: oauth2
    flow: clientCredentials
    token_endpoint: https://id.cisco.com/oauth2/default/v1/token
    token_request:
      method: POST
      content_type: application/x-www-form-urlencoded
      parameters:
        - grant_type=client_credentials
        - client_id=<application Client ID>
        - client_secret=<application Client Secret>
    token_response_fields: [access_token, token_type, expires_in]
    token_type: Bearer
    token_lifetime_seconds: 3599
    refresh: >-
      No refresh token. The client repeats the client_credentials request to mint a
      new access token before or after expiry.
    request_header: 'Authorization: Bearer <access_token>'
    scopes_required: >-
      None. The Support APIs do not document per-API OAuth scopes. Which of the
      eight APIs an application may call is selected at registration time in the
      Cisco API Console and bound to the client_id, not requested per token.
    applied_to: All operations on all eight Support APIs.
authorization_server:
  issuer: https://id.cisco.com/oauth2/default
  metadata: well-known/cisco-support-apis-openid-configuration.json
  metadata_url: https://id.cisco.com/oauth2/default/.well-known/openid-configuration
  metadata_status: 200
  authorization_endpoint: https://id.cisco.com/oauth2/default/v1/authorize
  token_endpoint: https://id.cisco.com/oauth2/default/v1/token
  jwks_uri: https://id.cisco.com/oauth2/default/v1/keys
  grant_types_supported_includes_client_credentials: true
  platform: Okta (Cisco Common Identity)
credential_issuance:
  console: https://apiconsole.cisco.com/
  docs: https://developer.cisco.com/docs/support-apis/application-registration/
  steps:
    - Log in to the Cisco API Console.
    - Select the "My Apps & Keys" tab and click "Register a New App".
    - Under OAuth2.0 Credentials select "Client Credentials" (only).
    - Select which Support APIs the application should have access to.
    - Accept the terms of service and register; the Client ID/Secret are emailed and shown in the console.
  secret_rotation: >-
    Client ID/Secret do not expire. They can be revoked and regenerated by the API
    user in the API Console if compromised.
entitlement_gate:
  required: true
  docs: https://developer.cisco.com/docs/support-apis/user-onboarding-process/
  detail: >-
    Support APIs are available only to Cisco Smart Net Total Care (SNTC) customers
    and Cisco Partner Support Service (PSS) partners. A customer user is onboarded
    by their organization's SNTC Delegated Administrator through the Cisco Services
    Access Management tool; a partner user requests access through the Cisco Partner
    Support Service community and must supply a PSS contract number. Cisco documents
    the partner path as taking up to 48 hours.
  consequence: >-
    An unentitled caller cannot obtain a working token. Live unauthenticated probes
    return HTTP 403 with X-Mashery-Error-Code ERR_403_NOT_AUTHORIZED
    (apix.cisco.com) or ERR_403_DEVELOPER_INACTIVE (api.cisco.com).
observed:
  - url: https://apix.cisco.com/sn2info/v2/coverage/status/serial_numbers/FOC10220LK9
    status: 403
    x_mashery_error_code: ERR_403_NOT_AUTHORIZED
    body: 'Authorization Header is either empty or not found in request'
  - url: https://api.cisco.com/sn2info/v2/coverage/status/serial_numbers/FOC10220LK9
    status: 403
    x_mashery_error_code: ERR_403_DEVELOPER_INACTIVE
known_drift:
  - what: Token endpoint moved
    detail: >-
      Cisco's own published Postman environment (CiscoDevNet/Cisco_Support_API_Postman,
      last pushed 2020-08-07) still sets authServer=cloudsso.cisco.com and posts to
      /as/token.oauth2. That host no longer serves OIDC discovery (404) and the
      current documentation names https://id.cisco.com/oauth2/default/v1/token.
  - what: API host moved
    detail: >-
      The same Postman environment sets apiServer=api.cisco.com while the current
      documentation examples all use apix.cisco.com. Both hosts are live Mashery
      gateways but return different unauthenticated error codes.