generated: '2026-09-09' method: searched source: https://docs.fenergox.com/api-docs/fenergo-saas-api-specifications/authentication docs: - https://docs.fenergox.com/api-docs/fenergo-saas-api-specifications/authentication - https://docs.fenergox.com/api-docs/tenant-access - https://docs.fenergox.com/developer-hub/api-and-system-security/api-scopes-and-access-control - https://docs.fenergox.com/developer-hub/api-and-system-security/api-security-and-best-practice summary: types: - oauth2 - openIdConnect - apiKey - http - mutualTLS api_key_in: - header oauth2_flows: - clientCredentials - authorizationCode primary: OAuth 2.0 client_credentials against Duende IdentityServer; Bearer JWT in the Authorization header model: identity_provider: Duende IdentityServer (Enterprise Edition) issuer: https://identity.fenergox.com token_endpoint: https://identity.fenergox.com/connect/token mtls_token_endpoint: https://api-mtls.fenergox.com/sts/connect/mtls/token regional_pattern: https://identity.{region}.fenergox.com/connect/token token_type: Bearer JWT token_ttl_seconds: 900 recommended_grant: client_credentials sso: Client IdPs supported via OIDC, SAML, WS-Fed and Google Auth for UI users; portal users via Auth0 username_password: Not supported for API access — credentials are exchanged once for a short-lived access token required_headers: - header: Authorization value: Bearer {access_token} required: true note: Declared in 130 of the harvested OpenAPI contracts as an apiKey securityScheme named "Bearer" in the header. - header: x-tenant-id value: '{tenant GUID}' required: true note: Mandatory on every CLM API call and declared as a parameter on 2,324 of the 2,381 harvested operations. A missing header returns HTTP 400 with errorCode MissingTenantHeader. It is NOT required on the token request itself. - header: x-correlation-id value: '{GUID}' required: false note: Optional tracing header, declared on 86 operations; propagated onto event notifications as correlationId. mutual_tls: supported: true token_endpoint_auth_methods: - client_secret_basic - client_secret_post - tls_client_auth - self_signed_tls_client_auth endpoint: https://api-mtls.fenergox.com/sts/connect/mtls/token source: https://docs.fenergox.com/developer-hub/api-and-system-security/api-security-and-best-practice scopes: artifact: scopes/fenergo-scopes.yml documented_count: 105 docs: https://docs.fenergox.com/developer-hub/api-and-system-security/api-scopes-and-access-control caching_guidance: Fenergo instructs clients to cache and reuse the access token for its full 15-minute TTL; the identity domain is limited to 100 token requests per IP per 5 minutes. schemes: - name: Bearer type: apiKey in: header parameter: Authorization description: Please insert JWT with Bearer into field sources: - openapi/fenergo-advanceddashboardcommand-v1-0-openapi.json - openapi/fenergo-advanceddashboardquery-v1-0-0-openapi.json - openapi/fenergo-associationcommand-v1-0-openapi.json - openapi/fenergo-associationcommand-v2-0-openapi.json - openapi/fenergo-associationquery-v1-0-openapi.json - openapi/fenergo-auditquery-v1-0-openapi.json - openapi/fenergo-auditquery-v2-0-openapi.json - openapi/fenergo-auditquery-v3-0-openapi.json - openapi/fenergo-authorizationcommand-v1-0-openapi.json - openapi/fenergo-authorizationquery-v1-0-openapi.json - openapi/fenergo-authorizationquery-v2-0-openapi.json - openapi/fenergo-authorizationquery-v3-0-openapi.json - openapi/fenergo-bulkloadcommand-v1-0-openapi.json - openapi/fenergo-bulkloadcommand-v2-0-openapi.json - openapi/fenergo-bulkloadquery-v1-0-openapi.json - openapi/fenergo-businessmetricscommand-v1-0-0-openapi.json - openapi/fenergo-businessmetricsquery-v1-0-openapi.json - openapi/fenergo-changemanagementcommand-v1-0-openapi.json - openapi/fenergo-changemanagementquery-v1-0-openapi.json - openapi/fenergo-collateralcommand-v1-0-openapi.json - openapi/fenergo-collateralquery-v1-0-openapi.json - openapi/fenergo-configbaselinecommand-v1-7-2-openapi.json - openapi/fenergo-configbaselinequery-v1-9-3-openapi.json - openapi/fenergo-configexchangecommand-v1-0-openapi.json - openapi/fenergo-configexchangequery-v1-0-openapi.json - openapi/fenergo-configreleasehubcommand-v1-0-openapi.json - openapi/fenergo-covenantsconditionscommand-v1-0-openapi.json - openapi/fenergo-covenantsconditionsquery-v1-0-openapi.json - openapi/fenergo-creditassessmentcommand-v1-0-openapi.json - openapi/fenergo-creditassessmentquery-v1-0-openapi.json - openapi/fenergo-creditscreeningcommand-v1-0-openapi.json - openapi/fenergo-creditscreeningquery-v1-0-openapi.json - openapi/fenergo-dashboardscommand-v1-0-0-openapi.json - openapi/fenergo-dashboardsquery-v1-0-0-openapi.json - openapi/fenergo-datamigrationcommand-v1-0-openapi.json - openapi/fenergo-datamigrationcommand-v2-0-openapi.json - openapi/fenergo-datamigrationquery-v1-0-openapi.json - openapi/fenergo-dataprotectioncommand-v1-0-openapi.json - openapi/fenergo-dataprotectionquery-v1-0-openapi.json - openapi/fenergo-dealscommand-v1-0-openapi.json - openapi/fenergo-dealsquery-v1-0-openapi.json - openapi/fenergo-digitalagentscommand-v1-0-openapi.json - openapi/fenergo-digitalagentsquery-v1-0-openapi.json - openapi/fenergo-digitalidvcommand-v1-0-openapi.json - openapi/fenergo-digitalidvcommand-v2-0-openapi.json - openapi/fenergo-digitalidvquery-v1-0-openapi.json - openapi/fenergo-digitalidvquery-v2-0-openapi.json - openapi/fenergo-docgencommand-v1-0-openapi.json - openapi/fenergo-docgenquery-v1-0-openapi.json - openapi/fenergo-documentmanagementcommand-v1-0-openapi.json - openapi/fenergo-documentmanagementcommand-v2-0-openapi.json - openapi/fenergo-documentmanagementquery-v1-0-openapi.json - openapi/fenergo-entitydatacommand-v1-0-openapi.json - openapi/fenergo-entitydatacommand-v2-0-openapi.json - openapi/fenergo-entitydatacommand-v3-0-openapi.json - openapi/fenergo-entitydataquery-v1-0-openapi.json - openapi/fenergo-entitydataquery-v2-0-openapi.json - openapi/fenergo-entityprofilecommand-v1-0-openapi.json - openapi/fenergo-entityprofilequery-v1-0-openapi.json - openapi/fenergo-eventingress-v1-0-openapi.json - openapi/fenergo-eventnotifications-v1-0-openapi.json - openapi/fenergo-eventnotifications-v2-0-openapi.json - openapi/fenergo-externalauthenticationcommand-v1-0-openapi.json - openapi/fenergo-externalauthenticationquery-v1-0-openapi.json - openapi/fenergo-externaldatabff-v1-0-openapi.json - openapi/fenergo-externaldatacommand-v1-0-openapi.json - openapi/fenergo-externaldataquery-v1-0-openapi.json - openapi/fenergo-externaloutreachcommand-v1-0-openapi.json - openapi/fenergo-externaloutreachcommand-v2-0-openapi.json - openapi/fenergo-externaloutreachcommand-v3-0-openapi.json - openapi/fenergo-externaloutreachquery-v1-0-openapi.json - openapi/fenergo-financialanalysiscommand-v1-0-openapi.json - openapi/fenergo-financialanalysisquery-v1-0-openapi.json - openapi/fenergo-identity-scim-v1-openapi.json - openapi/fenergo-identitymanagementcommand-v1-0-openapi.json - openapi/fenergo-identitymanagementquery-v1-0-openapi.json - openapi/fenergo-integrationcore-v1-0-openapi.json - openapi/fenergo-journeycommand-v1-0-openapi.json - openapi/fenergo-journeylogicengine-v1-0-openapi.json - openapi/fenergo-journeylogicengine-v2-0-openapi.json - openapi/fenergo-journeyquery-v1-0-openapi.json - openapi/fenergo-localisationcommand-v1-0-openapi.json - openapi/fenergo-localisationquery-v1-0-openapi.json - openapi/fenergo-logging-centre-v1-0-openapi.json - openapi/fenergo-lookupcommand-v1-0-openapi.json - openapi/fenergo-lookupquery-v1-0-openapi.json - openapi/fenergo-narrativecommand-v1-0-openapi.json - openapi/fenergo-narrativequery-v1-0-openapi.json - openapi/fenergo-newrequest-v1-0-openapi.json - openapi/fenergo-outreachcommand-v1-0-0-openapi.json - openapi/fenergo-outreachquery-v1-0-0-openapi.json - openapi/fenergo-policyagent-v1-0-openapi.json - openapi/fenergo-policycommand-v1-0-openapi.json - openapi/fenergo-policycommand-v2-0-openapi.json - openapi/fenergo-policylogicengine-v1-0-openapi.json - openapi/fenergo-policylogicengine-v2-0-openapi.json - openapi/fenergo-policylogicengine-v3-0-openapi.json - openapi/fenergo-policyproviderscommand-v1-0-openapi.json - openapi/fenergo-policyprovidersquery-v1-0-openapi.json - openapi/fenergo-policyquery-v1-0-openapi.json - openapi/fenergo-policyquery-v2-0-openapi.json - openapi/fenergo-policyquery-v3-0-openapi.json - openapi/fenergo-policyquery-v4-0-openapi.json - openapi/fenergo-portal-bff-v1-0-0-0-openapi.json - openapi/fenergo-portaltenantcommand-v4-0-openapi.json - openapi/fenergo-portaltenantquery-v4-0-openapi.json - openapi/fenergo-productcommand-v1-0-openapi.json - openapi/fenergo-productpolicycommand-v1-0-openapi.json - openapi/fenergo-productpolicylogicengine-v1-0-openapi.json - openapi/fenergo-productpolicyquery-v1-0-openapi.json - openapi/fenergo-productquery-v1-0-openapi.json - openapi/fenergo-reportingquery-v1-0-0-openapi.json - openapi/fenergo-reportscommand-v1-0-openapi.json - openapi/fenergo-reportscommand-v2-0-openapi.json - openapi/fenergo-reportsquery-v1-0-openapi.json - openapi/fenergo-reportsquery-v2-0-openapi.json - openapi/fenergo-reviewcommand-v1-0-openapi.json - openapi/fenergo-reviewquery-v1-0-openapi.json - openapi/fenergo-riskcommand-v1-0-openapi.json - openapi/fenergo-riskquery-v1-0-openapi.json - openapi/fenergo-screeningcommand-v1-0-openapi.json - openapi/fenergo-screeningcommand-v2-0-openapi.json - openapi/fenergo-screeningcommand-v3-0-openapi.json - openapi/fenergo-screeningquery-v1-0-openapi.json - openapi/fenergo-screeningquery-v2-0-openapi.json - openapi/fenergo-screeningquery-v3-0-openapi.json - openapi/fenergo-screeningquery-v4-0-openapi.json - openapi/fenergo-significancecommand-v1-0-openapi.json - openapi/fenergo-significancequery-v1-0-openapi.json - openapi/fenergo-smartdocs-v1-0-openapi.json - openapi/fenergo-webhooks-v1-0-openapi.json - name: exportToken type: oauth2 flows: - flow: clientCredentials tokenUrl: https://your_api_endpoint/oauth2/token scopes: 1 sources: - openapi/fenergo-tm-dataexport-api-spec-openapi.json - openapi/fenergo-tm-realtime-api-spec-openapi.json - openapi/fenergo-tm-rule-execution-api-spec-openapi.json - openapi/fenergo-tm-rule-rerun-api-spec-openapi.json - openapi/fenergo-tm-rule-scheduling-api-spec-openapi.json - openapi/fenergo-tm-transaction-batch-api-spec-openapi.json - name: HTTPBearer type: http scheme: bearer sources: - openapi/fenergo-tm-profile-api-spec-openapi.json x-evidence: - url: https://identity.fenergox.com/.well-known/openid-configuration http_status: 200 fetched: '2026-09-09' - url: https://api.fenergox.com/entitydataquery/swagger/swagger-ui-init.js http_status: 400 note: Returned {"ErrorCode":"MissingTenantHeader"} — confirms the tenant header is enforced at the gateway.