- Getting started
- Swagger definition
- Orchestrator APIs
- Alerts requests
- Assets Requests
- Calendars requests
- Environments requests
- Folders requests
- Generic Tasks requests
- Jobs requests
- Libraries requests
- License requests
- Packages requests
- Permissions Requests
- Processes requests
- Robots requests
- Roles requests
- Schedules requests
- Settings requests
- Tasks requests
- Task Catalogs requests
- Task Forms requests
- Tenants Requests
- Transactions requests
- Users requests
- Webhooks requests
API Authentication ensures only authorized parties can interact with the available resources and perform necessary actions. UiPath offers multiple methods of authentication for different scenarios.
Learn more about the available authentication methods in the Automation Suite guide.
Local User Authentication via a Bearer Token (ROPC authentication)
We support authentication through ROPC for backwards compatibility for Orchestrator instances that have been migrated from standalone to Automation Suite deployments.Only Host administrators should authenticate using the /api/account/authenticate/ endpoint.Business users should authenticate using External Applications.
The resource owner password credentials authentication method is tenant scoped, therefore external application won't be able to authenticate using this method, as an external app cannot be created at tenant level.
-
To retrieve the access token, make a POST request to the
{OrchestratorURL}/api/account/authenticateendpoint with the following payload:{ "TenancyName": "{account_tenancy_name}", "UsernameOrEmailAddress": "{account_username}", "Password": "{account_password}" }{ "TenancyName": "{account_tenancy_name}", "UsernameOrEmailAddress": "{account_username}", "Password": "{account_password}" }In the above request:
{account_tenancy_name}—is the tenant unique identifier in your Automation Suite account{account_username}—is the username of your Automation Suite account{account_password}—is the password used to log in to your Automation Suite account
-
To find the
TenancyNamevalue of your Orchestrator instance, make a GET request to the/odata/Users/UiPath.Server.Configuration.OData.GetCurrentUserendpoint.The response body returns the bearer token, used by your application to authorize further API calls. Therefore, in the Authorization header of an API call, append
Bearer xxxxand replacexxxxwith the{access_token}value (for example,Authorization: Bearer eyJhbG ... LnVxjA).{ "result": "{access_token}", "targetUrl": null, "success": true, "error": null, "unAuthorizedRequest": false, "__abp": true }{ "result": "{access_token}", "targetUrl": null, "success": true, "error": null, "unAuthorizedRequest": false, "__abp": true }By default, the access token is valid for 30 minutes. To generate a new one, make another call to the
api/account/authenticateendpoint.Important:If your organization uses the Azure Active Directory model, you must register external applications in Orchestrator and use the OAuth flow.
Accessing Swagger
If you are using Swagger to try our API, just log in to your Orchestrator instance in a separate tab.
The Orchestrator API Swagger definition can be accessed by adding the /swagger/ui/index#/ suffix to your Orchestrator URL. For example, https://{yourDomain} /swagger/ui/index#/.
Domain User Authentication
API access with Windows Auto-logon (NTLM authentication) has been removed, as indicated in the deprecation timeline.
We recommend that you use the OAuth flow instead, which requires registering external applications in Orchestrator.
If the external application is already registered, refer to Using OAuth for External Apps.