generated: '2026-09-04'
method: searched
source: >-
  openapi/webscale-networks-webscale-apis-openapi.json (components.securitySchemes.access_key) and
  https://control.webscale.com/docs/api; live unauthenticated probes of https://api.webscale.com/v2
docs: https://control.webscale.com/docs/api
name: Webscale APIs authentication
api: Webscale APIs
base_url: https://api.webscale.com/v2

summary:
  types:
  - http
  model: single bearer credential, applied globally
  oauth2: false
  oidc: false
  mtls: false
  api_key_header: false
  scopes: none
  mfa_for_api: not applicable (console MFA is documented separately)

schemes:
- name: access_key
  type: http
  scheme: Bearer
  applied: 'globally via the root-level security: [{access_key: []}]'
  transport:
    primary:
      header: Authorization
      form: 'Authorization: Bearer <access-key-secret>'
      rfc: RFC 7235 section 5.1 (cited by the provider in the scheme description)
    alternative:
      query_parameter: authorization
      declared_at: components.parameters.authorization
      description_verbatim: >-
        Access token.  The authorization request header and this query parameter are exclusive.
        Exactly one must be provided.
      caution: >-
        A bearer token in a query string is written to access logs, proxy logs and browser history.
        Prefer the header. Recorded because the provider offers it, not because it is advisable.
  description_verbatim: >-
    An access key secret must be sent as a bearer token with each HTTP request in an `Authorization`
    header.
  token_acquisition:
  - method: user access key
    how: Create an access key in your user profile.
    url: https://control.webscale.com/profile
    api: POST /users/{id}/access-keys
    list: GET /users/{id}/access-keys
    revoke: DELETE /users/{user_id}/access-keys/{id}
  - method: service user secret
    how: An access key secret created when a service user is created.
    api: POST /accounts/{id}/service-users
    note: The non-human/machine principal path. This is what an agent or CI job should use.
  - method: temporary access key
    how: >-
      Obtain a temporary access key using an existing access key secret for a specified account.
    api: POST /users/{id}/authorization
    read: GET /users/{id}/authorization
    note: >-
      The closest thing this API has to token exchange — a long-lived secret is traded for a
      short-lived, account-scoped token. The contract does not publish the resulting token's lifetime.
  sources:
  - openapi/webscale-networks-webscale-apis-openapi.json
  - https://control.webscale.com/docs/api

authorization_model:
  style: role and group based, managed through the API
  objects:
    roles: /accounts/{id}/roles
    role_invitations: /accounts/{id}/invitations
    groups: /accounts/{id}/groups
    group_invitations: /accounts/{id}/group-invitations
    user_role_membership: /users/{id}/roles, /users/{id}/roles/{role_id}
    user_group_membership: /users/{id}/groups, /users/{id}/groups/{group_id}
    service_users: /accounts/{id}/service-users
  scopes_published: false
  permission_reference_published: false
  finding: >-
    Authorization is real and richly modelled — 20 operations across roles, groups, invitations and
    memberships — but NO permission or scope reference is published. There is no document saying which
    role grants which operation, and the contract attaches no per-operation scope requirement. A caller
    cannot determine in advance whether a given key may perform a given call; they must attempt it.

token_properties:
  expiry_published: false
  rotation_policy_published: false
  revocation: DELETE /users/{user_id}/access-keys/{id}
  prefix: none published
  format: opaque secret

observed_runtime:
  method: probed
  probed: '2026-09-04'
  unauthenticated_response:
    status: 401
    body: '{ "status": 401, "error": { "type": "unauthorized", "message": "Your request must include an authorizationheader including a bearer token" } }'
    header_www_authenticate: not returned
  control_probe: >-
    A nonsense path (/v2/definitely-not-a-real-endpoint-9f3a) returns the identical 401 body as a real
    path (/v2/applications). The API does not distinguish "unauthenticated" from "not found" to an
    anonymous caller — an intentional non-enumeration posture.
  note: >-
    The live 401 body does not match the contract's declared `Error` schema. See
    errors/webscale-networks-problem-types.yml.

discovery_documents:
  openid_configuration: not served (404 on webscale.com, api.webscale.com, docs.webscale.com)
  oauth_authorization_server: not served
  oauth_protected_resource: not served
  note: See well-known/webscale-networks-well-known.yml for the full 48-probe record.

console_security_docs:
  mfa: https://docs.webscale.com/docs/how-tos/security/mfa/
  secure_access: https://docs.webscale.com/docs/how-tos/security/secure-access/
  password_guidance: https://docs.webscale.com/docs/how-tos/security/password-guidance/
  note: These cover human console login, not API credentials.