OAuth clients

Latest Dynatrace
Reference
2-min read

OAuth clients provide client credentials according to the OAuth standard. Credentials are managed by Dynatrace administrators and are used to set up integrations between Dynatrace and external systems or automate account management.

Create an OAuth2 client

Go to Account Management. If you have more than one account, select the account you want to manage.
On the top navigation bar, go to Identity & access management > OAuth clients.
Select Create client.
Provide an email of the user who owns the client.
Provide a description for the new client.
Select the required permissions.
These are the scopes that the client will be able to grant. Tokens generated by the client might have different scope sets.
Select Create client.
Copy the generated information to the clipboard. Store it in a password manager for future use.
You can only access your client secret once upon creation. You can't reveal it afterward.

Request a token

After you create the OAuth2 client, request the bearer token from the Dynatrace SSO system via an API call.

Provide the following parameters in the request body. Be sure to URL-encode all values!

Response

In this example, the response of the request contains the bearer token, which you need to pass to the API call.

{
  "token_type": "Bearer",
  "resource": "urn:dtaccount:{dynatrace-account-urn}",
  "access_token": "{your-bearer-token}",
  "expires_in": 300,
  "scope": "app-engine:apps:run storage:buckets:read storage:logs:read"
}

Authenticate

To authenticate a call, attach the token to the Authorization HTTP header preceding the Bearer realm.

--header 'Authorization: Bearer abcdefjhij1234567890'

The following example shows the authentication.

curl --request GET \
  --url https://api.dynatrace.com/iam/v1/accounts/{accountUuid}/users \
  --header 'Authorization: Bearer abcdefjhij1234567890' \