Phase Two Cluster Management API
Automate management of your Phase Two hosted Keycloak clusters: dedicated clusters, deployments (realms), custom domains, extensions, environment variables, IP rules, organizations, and billing.
This is the control plane API. It manages clusters themselves -- creating them, adding realms, attaching domains -- and is entirely separate from the Keycloak Admin REST API you use to configure what lives inside a realm.
Hosts
Two hostnames are involved: tokens are minted by the control-plane realm on the console host, while the operations in this reference are served from the API host.
| Console host (tokens) | API host (operations) |
|---|---|
app.phasetwo.io | api.phasetwo.io |
Authentication
Every request needs an OAuth2 access token obtained via the client credentials grant. Create an API secret for your organization -- in the console under your team's API Credentials tab, or via org.apiSecret.create -- then exchange its client ID and secret for a token:
curl -X POST https://app.phasetwo.io/auth/realms/self/protocol/openid-connect/token \
-d grant_type=client_credentials \
-d client_id=$PHASETWO_CLIENT_ID \
-d client_secret=$PHASETWO_CLIENT_SECRET
Send the resulting token as Authorization: Bearer <token> on every call. The client secret is shown only once, when the secret is created.
What a token can do is governed by the organization roles granted to its API secret, not by OAuth scopes.
Authentication
- OAuth 2.0: oidcClientCredentials
OIDC client credentials grant. Obtain a client ID/secret pair via the org.apiSecret.create operation, then exchange them for an access token at https://app.phasetwo.io/auth/realms/self/protocol/openid-connect/token.
Security Scheme Type: | oauth2 |
|---|---|
OAuth Flow (clientCredentials): | Scopes: |