generated: '2026-08-05' method: searched source: https://production.chariot.striveworks.us/docs/user_guide/administration/authentication docs: https://production.chariot.striveworks.us/docs/user_guide/administration/authentication summary: types: [oauth2, http, mutualTLS] oauth2_flows: [clientCredentials] bearer_token: true api_key_in: [] notes: >- Chariot is deployed per tenant, so every authentication URL below is relative to the customer's own Chariot host (the docs write it as https://). The Striveworks-operated instance used for these probes is https://production.chariot.striveworks.us. There is no published OpenAPI declaring securitySchemes, so this profile is captured from the provider's authentication documentation rather than derived from a spec. schemes: - name: client_credentials type: oauth2 flow: clientCredentials token_url: https:///auth/client/v2/chariot/login grant_type: client_credentials request_content_type: application/x-www-form-urlencoded request_parameters: [client_id, client_secret, grant_type] response_fields: [access_token, expires_in] credential_lifetime: >- Client credentials are created from the user's Profile page with a name and an expiration date of up to one year from the date of creation. source: https://production.chariot.striveworks.us/docs/user_guide/administration/authentication - name: bearer type: http scheme: bearer in: header parameter: Authorization format: 'Authorization: Bearer ' description: >- Bearer token returned by the client-credentials login endpoint; required on all subsequent requests to the Chariot REST API. source: https://production.chariot.striveworks.us/docs/user_guide/administration/authentication - name: pki type: mutualTLS description: >- PKI / client-certificate authentication for environments that require it. Supported via PKCS#12 bundle (pkcs12 + pkcs12_password) or separate certificate and key files (cert_filename, key_filename), both through the SDK connect() call and directly with an HTTP client. Can be combined with a bearer token. source: https://production.chariot.striveworks.us/docs/user_guide/administration/authentication sdk_helpers: - language: python package: chariot-client function: chariot.client.connect modes: [client_id + client_secret, bearer_token, pkcs12, cert_filename + key_filename] - language: cli command: chariot init modes: ['--credentials credentials.json', interactive] authorization_model: style: rbac docs: https://production.chariot.striveworks.us/docs/user_guide/administration/roles-permissions note: >- Authorization is role-based over organizations and projects rather than OAuth scopes; no scope strings are issued with the access token, so no scopes/ artifact is emitted for this provider. organization_roles: - name: Organization Owner description: Complete administrative control of the organization and all its contents; inherits project Owner permissions for every project in the organization. - name: Organization Maintainer description: Can add and remove users in the organization; cannot view private projects they are not a member of and cannot add or remove organization Owners. - name: Organization Contributor description: Member of the organization with read and write access to projects based on project visibility and membership; no organization-level administration. project_roles: - name: Project Owner description: Complete administrative control over the project. - name: Project Writer description: Can create and edit resources (datasets, models, and similar) within the project. - name: Project Reader description: Can view all project contents but cannot make edits. permissions: - {resource: org, permission: org_read} - {resource: org, permission: add_owner} - {resource: org, permission: remove_owner} - {resource: org, permission: org_update_settings} - {resource: org, permission: add_user} - {resource: org, permission: remove_user} - {resource: org, permission: project_create} - {resource: project, permission: project_read} - {resource: project, permission: project_write} - {resource: project, permission: project_delete} - {resource: project, permission: project_update_settings} - {resource: project, permission: add_owner} - {resource: project, permission: remove_owner} - {resource: project, permission: add_user} - {resource: project, permission: remove_user} - {resource: project, permission: secret_write} - {resource: project, permission: secret_decrypt} - {resource: project, permission: secret_list} - {resource: project, permission: dataset_read} - {resource: project, permission: dataset_create} - {resource: project, permission: dataset_write} - {resource: project, permission: training_job_read} - {resource: project, permission: training_job_create} - {resource: project, permission: training_job_write} - {resource: project, permission: annotation_task_read} - {resource: project, permission: annotation_task_create} - {resource: project, permission: annotation_task_write} - {resource: project, permission: model_read} - {resource: project, permission: model_create} - {resource: project, permission: model_write} - {resource: project, permission: inference_server_read} - {resource: project, permission: inference_server_create} - {resource: project, permission: inference_server_write} - {resource: project, permission: workspace_read} - {resource: project, permission: workspace_create} - {resource: project, permission: workspace_write} visibility_modifiers: [public, restricted, internal, private] x-evidence: - {fetched: '2026-08-05', url: 'https://production.chariot.striveworks.us/docs/user_guide/administration/authentication', http_status: 200} - {fetched: '2026-08-05', url: 'https://production.chariot.striveworks.us/docs/user_guide/administration/roles-permissions', http_status: 200} - {fetched: '2026-08-05', url: 'https://production.chariot.striveworks.us/api/identity/v2/users/me/', http_status: 401, body: '{"error":"invalid bearer token"}'}