Secure Access Credentials

Last updated
Save as PDF

Cisco Secure Access uses API keys to authorize access to its APIs.

Use Secure Access Credentials account keys with Secure Access workflow activities and Secure Access Endpoint Target targets.

Account key setup

Prerequisites

You need access to Admin > API Keys in Secure Access. Determine which Secure Access operations the workflow uses before selecting scopes.

Required scopes and permissions

Use a separate operational API key for Secure Access resource operations and a Key Admin API key for API-key administration. Grant only the scopes required by the workflows that use each account key.

Workflow operation or family	Required scope or permission
Get API Keys	admin.apikeys:read.
Private Resources	policies.privateresources:read for read operations and policies.privateresources:write for create, update, and delete operations.
Private Resource Groups	policies.privateresourcegroups:read for read operations and policies.privateresourcegroups:write for create, update, and delete operations.
Connector Groups and Connectors	deployments.resourceconnectors:read for read operations and deployments.resourceconnectors:write for create, update, and delete operations.
Network Tunnel Groups	deployments.networktunnelgroups:read for read operations and deployments.networktunnelgroups:write for create, update, and delete operations.
Network Tunnel Regions	deployments.regions:read.
Network Devices	deployments.networkdevices:read for read operations and deployments.networkdevices:write for create, update, and delete operations.

If you use Generic Secure Access API Request to call another endpoint, add the scopes required by that endpoint. Successful authentication does not confirm authorization for every endpoint.

For current scope mappings, see Secure Access OAuth 2.0 Scopes and the Secure Access Key Admin API overview.

Generating an API key

In Secure Access, go to Admin > API Keys.
Create an operational API key or Key Admin API key for the workflows that will use it.
Select the required scopes and an expiration date.
Generate the key, then copy the API Key ID and API Key Secret. The secret cannot be retrieved later.

Creating an account key

Complete the following steps to create a Secure Access Credentials account key:

From the left navigation menu, select Automation > Targets.
From the Account Keys tab, select New account key.
On the New Account Key page, select Secure Access Credentials from the Account Key Type list.
Enter a display name in Display Name and a brief description in Description.
In the Credentials area, enter the following information:
- API Key ID: Enter the API Key ID generated in Secure Access.
- API Key Secret: Enter the API Key Secret generated with the API Key ID.
Select Save.

Save operational and Key Admin API keys as separate Secure Access Credentials account keys, then select the account key appropriate for each target.