Phase Two Admin REST API
This is a REST API reference for the Phase Two Keycloak extensions. These are extensions to the standard Keycloak Admin REST API, and run on your cluster alongside it.
Base URI format
Paths specified in the documentation are relative to the base URI.
- Format:
https://<your-cluster-host>/auth/realms - Example:
https://auth.example.com/auth/realms
<your-cluster-host> is your cluster's hostname from the Phase Two Dashboard, or a custom domain attached to it.
Authentication
Send an access token in the Authorization: Bearer <token> header of every request. We recommend getting the token for a service account with the client credentials grant, using a confidential client you create for API access.
A Keycloak admin client library, such as the Keycloak Admin Client for JavaScript, can take care of getting an access token and refreshing it when it expires.
Client credentials grant example
POST /auth/realms/my-realm/protocol/openid-connect/token
Host: auth.example.com
Accept: application/json
Content-Type: application/x-www-form-urlencoded
grant_type=client_credentials&client_id=api-client&client_secret=<client-secret>
The response contains the access token, its type, and its lifetime in seconds:
{
"access_token": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...",
"token_type": "Bearer",
"expires_in": 300
}
SDKs
Modern API libraries are available for several common languages. These are available as open source at the links below, or you can choose to generate your own using our OpenAPI spec file.
| Language | Library |
|---|---|
| Java (and other JVM langs) | https://github.com/p2-inc/phasetwo-java |
| JavaScript/TypeScript | https://github.com/p2-inc/phasetwo-js |
| Python | https://github.com/p2-inc/phasetwo-python |
Authentication
- HTTP: Bearer Auth
Security Scheme Type: | http |
|---|---|
HTTP Authorization Scheme: | bearer |