OAuth clients

OAuth clients provide you client credentials as per the OAuth standard. They can be managed by Dynatrace administrators and are used to set up integrations between Dynatrace and external systems or to automate account management.

Create an OAuth2 client

Go to Account Management. If you have more than one account, select the account you want to manage.
On the top navigation bar, go to Identity & access management > OAuth clients.
Select Create client.
Provide an email of the user who owns the client.
Provide a description for the new client.
Select the required permissions.
These are the scopes that the client will be able to grant. Tokens generated by the client might have different scope sets.
Select Create client.
Copy the generated information to the clipboard. Store it in a password manager for future use.
You can only access your client secret once upon creation. You can't reveal it afterward.

Request a token

After you create the OAuth2 client, request the bearer token from the Dynatrace SSO system via an API call.

POST	`https://sso.dynatrace.com/sso/oauth2/token`
Content type	`application/x-www-form-urlencoded`

Provide the following parameters in the request body. Be sure to URL-encode all values!

Parameter	Value
grant_type	`client_credentials`
client_id	`{your-Client-ID}`
client_secret	`{your-Client-secret}`
scope	A list of required scopes separated by a whitespace, for example `account-uac-read account-uac-write`. You can assign multiple scopes to a single token, or you can generate several tokens, each with different access levels and use them accordingly—check your organization's security policies for the best practice.
resource	`urn:dtaccount:{your-account-UUID}`

The response of the request contains the bearer token.

Authenticate

To authenticate a call, attach the token to the Authorization HTTP header preceding the Bearer realm.

--header 'Authorization: Bearer abcdefjhij1234567890'

The following example shows the authentication.

curl --request GET \
  --url https://api.dynatrace.com/iam/v1/accounts/2b794097-8ad2-4b32-b923-0131da2eeddf/users \
  --header 'Authorization: Bearer abcdefjhij1234567890' \