Cisco Secure Access API, Authentication

Authentication

The Secure Access API provides a standard REST interface and supports the OAuth 2.0 Client Credentials Flow. To get started, sign in to Secure Access and create your Secure Access API keys.

Note: API keys, passwords, secrets, and tokens allow access to your private customer data. Never share your credentials with another user or organization.

API key use cases

You can use your Secure Access API keys in client programs that interact with the Secure Access platform. Create KeyAdmin keys to manage your Secure Access API keys.

Walkthrough: Secure Access API authentication

Best practices: Secure Access API authentication

Prerequisites

• You must have a Cisco Secure Access user account with the Full Admin user role.
• You must have a Cisco Security Cloud Single Sign-On (SCSO) account to sign in to Secure Access.

For more information, see Cisco Secure Access Help.

Sign in to Secure Access

1. Sign in to Secure Access at:

   https://login.sse.cisco.com

2. Enter the email address for your Secure Access account.

3. Select SIGN IN.

Manage API keys

Create and manage Secure Access API keys.

• Review API key status
• Create an API key
• Refresh a Secure Access API key
• Update a Secure Access API key
• Delete a Secure Access API key

Review API key status

Use the API Keys tile to review the API keys in your organization. The tile shows the total number of API keys, how many have expired, and how many expire soon.

Select the API Keys tile to switch to the API key list, locate a key, and manage it.

Create an API key

Create an API key and secret.

Note: You have only one opportunity to copy your API secret. Secure Access does not save your API secret and you cannot retrieve the secret after its initial creation.

1. Navigate to Admin > API Keys.

2. If the API Keys tile is not already selected, select it. Then select Add.

   

3. Enter a name and description for the key. A name must contain fewer than 256 characters. The key description is optional.

   

4. Expand each key scope and select the categories that provide access to the API endpoints you need. For each selected scope and resource, choose Read Only or Read / Write. For details about available scopes, see OAuth 2.0 Scopes.

   

5. For Expiry Date, choose the expiration date for the key, or choose Never expire.

   

6. (Optional) For Network restrictions, enter a comma-separated list of public IP addresses or CIDRs, then select Add. To remove a network address, select x beside it.

   Note: You can add up to ten networks to your API key. You can only use your API key to authenticate requests for clients on the selected networks.

   

7. Select CREATE KEY.

8. Copy and save your API Key and Secret Key.

   

   Note: If you do not save your API secret, you cannot retrieve it later. To get a new secret, refresh the API key, then copy and save the new API Key and Secret Key.

9. Select Accept and Close.

Refresh a Secure Access API key

Refresh an API key if it has expired or if you did not save its secret when you created it. Secure Access displays the new secret only once, so copy and save it before closing the dialog.

1. Navigate to Admin > API Keys.

2. If the API Keys tile is not already selected, select it. Then expand the API key you want to refresh.

3. Scroll to the API Key ID and API Key Secret fields, then select Refresh Key.

   

4. Select Refresh.

   

5. Copy and save your API Key and Secret Key.

   

   Note: You have only one opportunity to copy your API secret. Secure Access does not save your API secret and you cannot retrieve the secret after its initial creation.

6. Select Accept and Close.

Update a Secure Access API key

Update a Secure Access API key.

1. Navigate to Admin > API Keys.

2. If the API Keys tile is not already selected, select it. Then expand the API key you want to update.

3. You can modify the API Key Name, Description, selected scopes in Key Scope, and Expiry Date.

4. For Network restrictions, update the list of IP addresses and CIDRs. To remove a network address, select x beside it.

5. Select Save.

Delete a Secure Access API key

Delete a Secure Access API key.

1. Navigate to Admin > API Keys.
2. If the API Keys tile is not already selected, select it.
3. In the API Keys table, find the key you want to delete. To filter the list, enter an API name, key, or creator in the Search by API Name, Key or Creator field. Select the checkbox beside the key.
4. In the action bar, select Delete.
5. In the confirmation dialog, verify that the correct key is listed, then select Delete. Deleted keys cannot be recovered.

Manage KeyAdmin API keys

Create and manage Secure Access KeyAdmin API keys.

• Review KeyAdmin API key status
• Create KeyAdmin key
• Refresh KeyAdmin key
• Update KeyAdmin key
• Delete KeyAdmin key

Review KeyAdmin API key status

Use the KeyAdmin Keys tile to review the KeyAdmin API keys in your organization. The tile shows the total number of keys, how many have expired, and how many expire soon.

Select the KeyAdmin Keys tile to switch to the KeyAdmin API key list, locate a key, and manage it.

Create KeyAdmin key

Create a KeyAdmin API key and secret.

Note: You have only one opportunity to copy your API secret. Secure Access does not save your API secret and you cannot retrieve the secret after its initial creation.

1. Navigate to Admin > API Keys.

2. If the KeyAdmin Keys tile is not already selected, select it. Then select Add.

   

3. Enter a name and optional description for the key. The name must contain fewer than 256 characters.

   

4. Select the permissions the key needs. List API Keys grants read-only access. Create API Keys, Update API Keys, Refresh API Keys, and Delete API Keys grant write access for those actions.

   

5. For Expiry Date, choose the expiration date for the key, or choose Never expire.

   

6. (Optional) For Network restrictions, add up to ten public IPv4 addresses or CIDR ranges, separating multiple values with commas. Select Add after each entry. To remove an address, select x beside it.

   Note: You can use the KeyAdmin API key to authenticate requests only from clients on the selected networks.

   

7. Select CREATE KEY.

8. Copy and save your KeyAdmin Key and Secret Key.

   

   Note: If you do not save the secret, you cannot retrieve it later. To get a new one, refresh the KeyAdmin API key, then copy and save the new key and secret.

9. Select Accept and Close.

Refresh KeyAdmin key

Refresh a KeyAdmin API key if it has expired or if you did not save its secret when you created it. Secure Access displays the new secret only once, so copy and save it before closing the dialog.

1. Navigate to Admin > API Keys.

2. If the KeyAdmin Keys tile is not already selected, select it. Then expand the KeyAdmin API key you want to refresh.

   

3. Scroll down to the Generated credentials section and select Refresh Key.

   

4. In the confirmation dialog, select Refresh.

5. Copy and save your KeyAdmin Key and Secret Key.

   

   Note: If you do not save the new secret, repeat this procedure to generate another one.

6. Select Accept and Close.

Update KeyAdmin key

Update a KeyAdmin API key.

1. Navigate to Admin > API Keys.

2. If the KeyAdmin Keys tile is not already selected, select it. Then select the KeyAdmin API key you want to update.

   

3. You can modify the KeyAdmin Key Name, Description, Permissions, and Expiry Date.

4. For Network restrictions, update the list of public IPv4 addresses or CIDR ranges. To remove an address, select x beside it.

5. Select Save.

Delete KeyAdmin key

Delete a KeyAdmin API key.

1. Navigate to Admin > API Keys.
2. If the KeyAdmin Keys tile is not already selected, select it.
3. In the KeyAdmin Keys table, find the key you want to delete. If needed, search by permission, key, or creator. Select the checkbox beside that key.
4. In the action bar, select Delete.
5. In the confirmation dialog, verify that the selected key is listed, then select Delete. Deleted keys cannot be recovered.