generated: '2026-08-29'
method: searched
source: openapi/stream-security-api-openapi.json
docs: https://docs.streamsec.io/docs/token-management
docs_secondary: https://docs.streamsec.io/reference/getting-started-with-stream-api
summary:
  types:
  - http
  oauth2: false
  openid_connect: false
  mutual_tls: false
  api_key_header: false
  note: >-
    A single scheme covers all 34 operations. There is no OAuth, no OIDC and no mTLS on the API.
    SAML SSO exists but is for CONSOLE sign-in only (Okta, Azure AD/Entra, Google Workspace and AWS
    documented as IdPs) - it does not issue API credentials.
schemes:
- name: BearerAuth
  type: http
  scheme: bearer
  bearerFormat: JWT
  header: 'Authorization: Bearer <API token>'
  applies_to: all 34 operations
  sources:
  - openapi/stream-security-api-openapi.json
  provisioning:
    location: Stream UI -> Organization Settings or Workspace Settings -> API Token Management
    who: Organization Admins (all tokens, all workspaces) and Workspace Admins (their workspace only)
    fields:
    - name (required)
    - description (optional)
    - permission (Read & Write / Read Only - Read Only documented as "supported soon")
    - scope (organization-wide or selected workspaces; Workspace Admins are limited to their own)
    - expiration (1 day, 7 days, 30 days, 90 days, 1 year, or never)
    disclosure: >-
      The full token is displayed exactly once at creation and must be copied and stored securely.
  lifecycle:
    rotation: manual - no programmatic token-issuance or rotation endpoint exists in the API
    revocation: >-
      Immediate on admin action. Revoked tokens remain visible in the management view for 90 days.
    automatic_revocation:
    - When a user account is deactivated, all tokens they created are revoked and labelled as such.
    - When a user is assigned a lower role, tokens exceeding the new role's permissions are revoked.
    - When a user is assigned a higher role, existing tokens remain active; new tokens reflect the
      updated role.
tenancy:
  header: workspace
  required: false
  behaviour: >-
    Requests default to the workspace bound to the token. A token with multi-workspace access
    targets one by sending its ID in the `workspace` header.
  discovery: GET /workspaces
  docs: https://docs.streamsec.io/docs/how-to-get-your-workspace-id
  mcp_divergence: >-
    The MCP server uses the header name `customer` for the same workspace ID, and supports only one
    workspace per token.
scopes:
  model: none
  note: >-
    No OAuth scopes. Authorization is a two-axis model - a coarse permission level (Read & Write /
    Read Only) crossed with a workspace scope. Consequently no scopes/ artifact is emitted:
    derive-oauth-scopes.py found no oauth2 securityScheme, which is the correct result rather than
    a gap in the pass.
errors:
  '401': Authorization not provided - missing, malformed or expired token.
  '403': Insufficient access - authenticated but outside the token's permission level or workspace scope.
  see: errors/stream-security-problem-types.yml