generated: '2026-08-13'
method: searched
source: openapi/cision-cisionone-openapi.yml
docs: https://cision.atlassian.net/wiki/spaces/CSM/pages/26385776684/CisionOne+-+API
name: Cision Authentication Profile
description: >-
  Cision runs two separately-authenticated API surfaces, both token-based and
  neither using OAuth. The CisionOne API takes a long-lived API token minted in
  the CisionOne Admin panel and passed as the X-Auth-Token header. The Next
  Generation Cision Communications Cloud API (served on the api.trendkite.com host
  Cision inherited with its 2019 TrendKite acquisition) exchanges platform
  username/password credentials for an access_token at POST /api/login and then
  passes that token on the same X-Auth-Token header.
summary:
  types: [apiKey]
  api_key_in: [header]
  oauth2_flows: []
  oauth2: false
  openid_connect: false
  mutual_tls: false
schemes:
  - name: api_key
    type: apiKey
    in: header
    parameter: X-Auth-Token
    description: >-
      CisionOne API token. Declared in the published OpenAPI as a component
      securityScheme AND repeated as a required header parameter on getMentions
      and getStreamStats. Applied to every operation with the scope string
      read:api.
    scopes_referenced: [read:api]
    sources:
      - openapi/cision-cisionone-openapi.yml
    api: cision:cisionone-api
  - name: cision_communications_cloud_token
    type: apiKey
    in: header
    parameter: X-Auth-Token
    description: >-
      Next Generation Cision Communications Cloud token. Obtained by POSTing
      {"username": ..., "password": ...} as application/json to
      https://api.trendkite.com/api/login; the JSON response carries access_token,
      which is then sent as the X-Auth-Token header on every subsequent request.
      No published expiry or refresh flow.
    token_endpoint: https://api.trendkite.com/api/login
    token_endpoint_method: POST
    credential: platform username + password
    response_field: access_token
    sources:
      - https://cision.atlassian.net/wiki/spaces/CSM/pages/25764989843/Settings+-+Cision+API
    api: cision:cision-communications-cloud-api
    method: searched
provisioning:
  - api: cision:cisionone-api
    how: >-
      API tokens are generated by an account administrator inside CisionOne
      Settings. There is no self-service developer signup and no public key
      issuance — API access is an entitlement on the commercial contract, and a
      token that lacks it receives HTTP 403 "Token does not have access to the API".
    docs: https://cision.atlassian.net/wiki/spaces/CSM/pages/25764989843/Settings+-+Cision+API
  - api: cision:cision-communications-cloud-api
    how: >-
      Uses the customer's existing Cision Communications Cloud login credentials
      against POST https://api.trendkite.com/api/login. No separate client
      registration.
notes:
  - No OAuth 2.0, no OpenID Connect and no mTLS on either surface; scopes/ is
    therefore not emitted for this provider.
  - CORS is supported on the Communications Cloud API; JSONP is explicitly not.
  - Failure semantics are distinguished in the spec — 401 is an invalid or missing
    token, 403 is a valid token whose account is not entitled to API access.