generated: '2026-08-23'
method: searched
source: https://docs.infoworks.io/developer-resources/rest-api
derived_from: openapi/infoworks-rest-api-v3-openapi.yml
docs: https://docs.infoworks.io/developer-resources/rest-api
summary:
  types: [http]
  model: >-
    Two-step: exchange a long-lived credential (HTTP Basic username:password, OR a refresh token
    copied from the Infoworks UI) for a short-lived JWT bearer token, then send that JWT on every
    subsequent call. There is no OAuth 2.0 authorization server and no API-key header, so there is no
    scope surface to document — see scopes/ (deliberately absent).
schemes:
- name: BearerAuth
  type: http
  scheme: bearer
  bearerFormat: JWT
  applied_to: >-
    Every non-/security operation in the spec declares security [{BearerAuth: []}] at the operation
    level. There is no root-level security block.
  token_lifetime: 15 minutes by default, configurable by the deployment administrator.
  sources: [openapi/infoworks-rest-api-v3-openapi.yml, https://docs.infoworks.io/developer-resources/rest-api]
- name: BasicAuth
  type: http
  scheme: basic
  applied_to: 'GET /security/authenticate only (token minting).'
  sources: [openapi/infoworks-rest-api-v3-openapi.yml, https://docs.infoworks.io/developer-resources/rest-api]
flows:
- name: username-and-password
  steps:
  - Base64-encode "<username>:<password>".
  - 'GET /v3/security/authenticate with header Authorization: Basic <encoded>.'
  - Read the JWT from result.authentication_token in the response body.
  - 'Send it on every subsequent call as Authorization: Bearer <token>.'
  constraint: Cannot be used when the deployment authenticates via SAML.
  operation: GET /security/authenticate
  docs: https://docs.infoworks.io/developer-resources/rest-api
- name: refresh-token
  steps:
  - In the Infoworks UI go to My Profile > Settings and copy the value in the Refresh Token section.
  - 'GET /v3/security/token/access with header Authorization: Basic <refresh_token>.'
  - Read the JWT from result.authentication_token.
  constraint: >-
    Works for any authentication mechanism, including SAML. Since v6.2.0 the platform enforces
    refresh-token expiry with administrator-configurable duration and automated expiry notifications.
  operation: GET /security/token/access
  docs: https://docs.infoworks.io/developer-resources/rest-api
token_management:
  validate: GET /security/token/validate
  revoke_access_token: DELETE /security/token/access (operationId deleteAuthToken, "Purge authentication token")
  rotate_refresh_token: DELETE /security/token/refresh ("Regenerate Refresh Token and blacklist old token")
enterprise_identity:
  saml:
    supported: true
    evidence: 'GET /security/sso/initialise ("Get SAML Redirect URL") in the Security tag.'
  ldap:
    supported: true
    evidence: 'POST /security/get/user/data ("LDAP Authorise User") and POST /security/bulk-ldap-sync.'
  service_authentication:
    supported: true
    evidence: >-
      A five-operation "Service Authentication" tag plus "Secret Store"/"Secrets" tags manage
      machine credentials and external secret stores (KEYVAULT / ADMIN config types appear in job-hook
      environment variable schemas).
notes:
- >-
  The auth model is per-deployment, not per-tenant on a vendor host: because Infoworks runs in the
  customer's own cloud, the token is issued by the customer's own Infoworks instance.
- >-
  No OAuth 2.0, no OpenID Connect discovery, no API-key scheme and no mTLS scheme are declared in the
  spec or documented. /.well-known/openid-configuration and /.well-known/oauth-authorization-server
  were probed on every reachable host and returned nothing (see well-known/infoworks-well-known.yml).