Authenticate your API client
You must perform an HTTP authentication request to authenticate your client against ARIS Process Mining. Depending on the specified authentication method, you can use client credentials or an authorization code.
You can find the required data in the system integration created for the data ingestion API.
Authentication against ARIS cloud using client credentials
Note that we firmly recommend the authentication using client credentials.
If you login to your project room using the URL mc.ariscloud.com, you are using the ARIS cloud.
Send an HTTP Post request to the ARIS cloud endpoint and path /api/applications/login (for example, https://mc.ariscloud.com/api/applications/login) with the following properties:
Content type: application/x-www-form-urlencoded
Request body with the values from the corresponding system integration:
clientId: client ID
clientSecret: client secret
tenant: project room name
The response is a JSON object that consists of the tenant, a URL, and an access token.
{
"tenant": "<project_room>",
"token": "…",
"url": "https://some_url"
}
Note
Use the value for the URL as the hostname for all subsequent calls to the REST endpoints.
Ensure that the generated bearer token is sent with the appropriate header for every subsequent request. To do this, add this HTTP-request header to each request as follows:
Authorization: Bearer <token from response>
Please note the blank space after the term "Bearer".
Authentication against ARIS Enterprise cloud with ARIS User Management using client credentials
Note that we firmly recommend the authentication using client credentials.
Send an HTTP Post request to ARIS User Management using the path /umc/api/oauth/apptoken (for example, https://my_company_name.ariscloud.com/umc/api/oauth/apptoken) with the following properties:
Content type: application/x-www-form-urlencoded
Request body with the values from the corresponding system integration:
client_id: client ID
client_secret: client secret
tenant: project room name
grant_type: client_credentials
The response is a JSON object that consists of an application token:
{
"applicationToken": "…"
}
Ensure that the generated bearer token is sent with the appropriate header for every subsequent request. To do this, add this HTTP-request header to each request as follows:
Authorization: Bearer <token from response>
Please note the blank space after the term "Bearer".
Authentication using authorization code
Note that your client application must support OAuth 2.0 with Authorization code grant type.
Configure the client application to use:
Callback URL
The callback URL to which you will be redirected to authenticate against your project room in ARIS Process Mining:
https://<region.ariscloud>/umc/rest/oauth/callback?tenant=<project_room>&provider=umc
You can read the hostname of the URL (for example, processmining.ariscloud.com) in the browser address bar if you are logged in.
Examples
If your project room is in the ARIS cloud, the callback URL could be as follows.
https://processmining.ariscloud.com/umc/rest/oauth/callback?tenant=<project_room>&provider=umc
If your project room is in the ARIS Enterprise cloud, the URL could be as follows.
https://<my_company_name>.ariscloud.com/umc/rest/oauth/callback?tenant=<project_room>&provider=umc
Client ID and client secret
You noted them when you created the system integration in ARIS Process Mining, or you can retrieve them from the list in the System Integration module in ARIS Process Mining Administration when you view the system access data for that system integration.
Client ID and secret must be sent in the body, not as a Basic OAuth header.
Authorization, token, and refresh endpoints can be retrieved by calling the corresponding well-known URL in your browser. You can retrieve the well-known URL from the list in the System Integration module in the ARIS Process Mining Administration when you view the system access data for that system integration. The URL will return a JSON object with authorization_endpoint, token_endpoint, refresh_endpoint, and userinfo_endpoint.
Example
{
"authorization_endpoint": "https://<hostname>/umc/oauthLogin?grant_type=authorization_code&tenant=<project_room>",
"token_endpoint": "https://<hostname>/umc/api/v1/oauth/accesstoken?grant_type=authorization_code&tenant=<project_room>",
"userinfo_endpoint": "https://<hostname>/umc/api/v1/oauth/userinfo?tenant=<project_room>",
"refresh_endpoint": "https://<hostname>/umc/api/v1/oauth/refreshtoken?tenant=<project_room>"}
}
After the client application sends an authentication request using these properties, the server responds with a JSON object that consists of the tenant, a URL, and an access token.
{
"tenant": "<project_room>",
"token": "…",
"url": "https://some_url"
}
Note
Use the value for the URL as the hostname for all subsequent calls to the REST endpoints.
Ensure that the generated bearer token is sent with the appropriate header for every subsequent request. To do this, add this HTTP-request header to each request as follows:
Authorization: Bearer <token from response>
Please note the blank space after the term "Bearer".
Additionally, for the authentication type Authorization Code a CSRF token must be sent with each request.
You can acquire a CSRF token after a successful authentication by sending an HTTP POST request to ARIS User Management at the path /umc/api/v2/tokens/csrftoken.
The result is a string of alphanumeric characters based on your current user session, for example, oehltw0drUujSdWMD5TJEsXSLklwk1xKYh1LHaZ16g7. You must send this token with the csrftoken header for each subsequent request.