Skip to main content
Version: 2.0.0

Phase Two Cluster Management API

Automate management of your Phase Two hosted Keycloak clusters: dedicated clusters, deployments (realms), custom domains, extensions, environment variables, IP rules, organizations, and billing.

This is the control plane API. It manages clusters themselves -- creating them, adding realms, attaching domains -- and is entirely separate from the Keycloak Admin REST API you use to configure what lives inside a realm.

Hosts​

Two hostnames are involved, and both differ by environment: tokens are minted by the control-plane realm on the console host, while the operations in this reference are served from the API host.

EnvironmentConsole host (tokens)API host (operations)
Production (default)app.phasetwo.ioapi.phasetwo.io
Stagingapp-staging.phasetwo.ioapi-staging.phasetwo.io

Everything below defaults to production. To work against staging, pick api-staging (or app-staging) in the server selector and select the oidcClientCredentialsStaging security scheme -- the token endpoint is a separate field that the server selector cannot retarget. The two must match: a token minted in one environment is not valid in the other.

Authentication​

Every request needs an OAuth2 access token obtained via the client credentials grant. Create an API secret for your organization -- in the console under your team's API Credentials tab, or via org.apiSecret.create -- then exchange its client ID and secret for a token:

curl -X POST https://app.phasetwo.io/auth/realms/self/protocol/openid-connect/token \
  -d grant_type=client_credentials \
  -d client_id=$PHASETWO_CLIENT_ID \
  -d client_secret=$PHASETWO_CLIENT_SECRET

Send the resulting token as Authorization: Bearer <token> on every call. The client secret is shown only once, when the secret is created.

What a token can do is governed by the organization roles granted to its API secret, not by OAuth scopes.

Authentication​

OIDC client credentials grant against production. Obtain a client ID/secret pair via the org.apiSecret.create operation, then exchange them for an access token at https://app.phasetwo.io/auth/realms/self/protocol/openid-connect/token. Use the scheme whose environment matches the server you selected.

Security Scheme Type:

oauth2

OAuth Flow (clientCredentials):

Scopes: