To access API Access Management, navigate to Administration > Integration > API Access Management.
API Access Management lets administrators create and manage OAuth credentials that let external systems authenticate to the Unqork API programmatically. Unlike user-based authentication, API credentials use a client ID and client to authenticate without requiring a logged-in user session.
Managing API access requires administrative permissions. Administrators needing access should contact their environment administrator.
Credential List
The page organizes credentials into the following tabs: Express and Creator. Each tab displays credentials of that type. Both tabs display the same columns. The Express tab displays a Role(s) column that supports multiple roles, while the Creator tab displays a single Role column.
| Column | Description |
|---|---|
| Name | A display name for the credential. |
| Client ID | The unique identifier used to authenticate API requests. |
| Created | The date and time the credential was created. |
| Expires | The date the credential expires. |
| Last Modified | The date and time the credential was last updated. |
| Role(s)/Role | The role or roles assigned to the credential. |
| Status | The current state of the credential. See Credential Statuses for details. |
| Actions | Credential-level actions. |
Adding a Credential
Regardless of the active tab, click Create New and choose either Express Access Credential or Creator Access Credential. The modal opens to the Credential Details tab.
Credential Details
Express credentials:
| Setting | Description |
|---|---|
| Name | A display name for the credential. |
| Description | An optional description of the credential's purpose or the system using it. |
| Role(s) | The Express roles assigned to the credential. Controls what the credential can access. Multiple roles can be assigned. |
| Group(s) | The Express groups assigned to the credential. Multiple groups can be assigned. Optional. |
| Days to Expiration | The count of days until the credential expires. Must be greater than 0 and cannot exceed 730. Defaults to 90. |
| Add Custom Attribute | Click Add Custom Attribute to add a key-value pair to the credential's session when it authenticates. Enter a Custom Attribute Name and Attribute Value for each. Multiple attributes can be added or removed. Optional. |
Creator credentials:
| Setting | Description |
|---|---|
| Name | A display name for the credential. |
| Description | An optional description of the credential's purpose or the system using it. |
| Role | The Creator role assigned to the credential. Controls what the credential can access. |
| Days to Expiration | The count of days until the credential expires. Must be greater than 0 and cannot exceed 730. Defaults to 90. |
| Add Custom Attribute | Click Add Custom Attribute to add a key-value pair to the credential's session when it authenticates. Enter a Custom Attribute Name and Attribute Value for each. Multiple attributes can be added or removed. Optional. |
Client ID and Secret
Click Create Credential to advance to the Client ID and Secret tab. The generated Client ID and Client Secret display here. Copy and store both securely.
The client secret cannot be retrieved after leaving this tab. If the secret is lost, delete the credential and create a new one. For Creator credentials, click Revoke to disable access without removing the credential.
Credential Actions
Click Actions on any row. Available options differ by credential type.
Express credentials:
| Action | Description |
|---|---|
 View |
Opens a read-only view of the credential's details. |
 Edit |
Updates the credential's name, description, roles, groups, or custom attributes. The client secret cannot be changed. |
 Generate New Secret |
Generates a new client secret and lets Creators set a new expiration period (1 to 730 days). The current secret is immediately invalidated. Not available for revoked credentials. |
 Delete |
Permanently removes the credential. |
Creator credentials:
| Action | Description |
|---|---|
| View |
Opens a read-only view of the credential's details. |
| Edit |
Updates the credential's name, description, role, or custom attributes. The client secret cannot be changed. |
| Generate New Secret |
Generates a new client secret and lets Creators set a new expiration period (1 to 730 days). The current secret is immediately invalidated. Not available for revoked credentials. |
 Revoke |
Permanently disables the credential. |
 Restore |
Re-enables a revoked credential. Available on revoked Creator credentials only. |
| Delete |
Permanently removes the credential. |
Credential Statuses
| Status | Description |
|---|---|
| Active | The credential is valid and can authenticate. |
| Expires Soon | The credential expires in fewer than 21 days. |
| Expired | The credential has passed its expiration date and can no longer authenticate. |
| Locked | The credential has been locked due to too many failed authentication attempts. Configure lockout thresholds in Environment Administration. |
| Revoked | The credential has been permanently disabled. |
Changelog
| Date | Change |
|---|---|
| 2026-10-08 | Corrected Credential Actions section: removed Days to Expiration from Edit action; added Generate New Secret action for both Express and Creator credentials. |
| — | Initial publication. |