Authenticate to Account Management with OAuth clients
The Account Management API helps you manage your account and its users. For example, you can manage access to Dynatrace environments by creating groups with various access levels and then associating these groups with users.
To be authenticated to use the Account Management API, you need a valid bearer token. Access to the API is fine-grained, meaning that you also need the proper permissions assigned to the token. See the description of each request to find out which permission is required to use it. The bearer token authenticates you via an OAuth2 client as a service user who is granted access to the API.
- You can designate any user on your account as a service user, but we recommend that you do not use the service user for any other purpose. The service user must belong to a group that provides account user management permissions.
- Create a separate Client ID for each application or integration that you build, and don't share clients between them. This approach provides you maximum control and security. Each client must have at least one scope. This enables you to authorize APIs on an application basis, as well as via the associated service user.
To obtain a token, you must create an OAuth2 client and then request the token from it. For more information, see OAuth clients.
Token scopes
The following token scopes are applicable to Account Management use cases.
| Name | API value |
|---|---|
Allow read access for identity resources (users and groups) |
|
Allow write access for identity resources (users and groups) |
|
Allow read access for environment resources |
|
Allow write access for environment resources |
|
Allow read access for usage and consumption resources |
|
Allow write access for usage and consumption resources |
|
Allow IAM policy configuration for environments |
|