Overview
Auvik SaaS Management data can be accessed through two API authentication methods. The correct method depends on your subscription and the API endpoint you are calling.
- Unified Auvik API: Uses an Auvik user email address and user API key.
- ASM API: Uses an ASM Integration Key and Secret.
These authentication methods are not interchangeable.
Method 1: Unified Auvik API
Use this method when your organization uses Auvik Network Management and Auvik SaaS Management together and you are calling Unified API endpoints.
Authentication
Use HTTP Basic Authentication with:
- Username: Your Auvik account email address
- Password: Your Auvik user API key
The API key is generated from the user account through the user menu or profile settings.
Permissions and scope
The API user must have:
- The required API permissions in the assigned role.
- Access to the clients, sites, or tenants being queried.
- An active Auvik Network Management subscription for Unified API access.
The API key inherits the permissions and site or tenant access of the user who created it.
Common issues
- Do not use an ASM Integration Key and Secret as the email and password for Unified API requests.
- Confirm that the request uses the correct Unified API region and base URL.
- A 403 response commonly indicates that the user lacks the required role permissions or site access.
- A 401 response commonly indicates invalid credentials or an authentication-format mismatch.
Method 2: ASM Integration Key and Secret
Use this method when:
- Your organization has an ASM-only environment.
- You are calling ASM-specific API endpoints.
- You have been instructed to use ASM integration credentials.
Authentication
Use the ASM Integration Key and Secret generated for your ASM organization.
These credentials use a different authentication method and endpoint structure than the Unified API.
Credential location
Depending on your ASM environment, generate or manage the credentials from:
Org Preferences > Integrations
Use the current ASM interface and API documentation to confirm the exact credential names and request format.
Permissions and scope
ASM Integration Key and Secret access is governed by the integration configuration rather than by the role of an individual Auvik user.
Keep the Secret secure and send credentials only over HTTPS as documented for the ASM API.
Common issues
- Do not use the ASM Integration Key and Secret as Basic Authentication credentials for Unified API endpoints.
- Do not include the Secret in a URL.
- Do not store the Secret in source code, tickets, screenshots, or logs.
- Regenerating the Secret immediately invalidates the previous Secret.
- Update all applications and integrations promptly after regenerating the Secret.
Choosing the correct method
Use this general guide:
- ASM-only environment: Use the ASM Integration Key and Secret.
- Auvik Network Management and ASM environment calling Unified endpoints: Use the Auvik user email and user API key.
- ASM-specific endpoint: Use the ASM authentication method documented for that endpoint.
- Unsure which method applies: Confirm the subscription, endpoint family, and API base URL before troubleshooting the credentials.
Troubleshooting authentication errors
401 Unauthorized
A 401 response usually indicates an authentication or credential-format problem.
Check:
- Whether you are using the correct API family.
- Whether the authentication method matches the endpoint.
- Whether the API key, Integration Key, or Secret was copied correctly.
- Whether the credential contains leading or trailing spaces.
- Whether the credential was regenerated or revoked.
- Whether the request uses the correct region and base URL.
403 Forbidden
A 403 response usually indicates that the credentials are valid but are not authorized for the requested resource.
For the Unified API, verify:
- The user’s role includes the required API permissions.
- The user has access to the requested clients, sites, or tenants.
- The organization has an active Network Management subscription.
For the ASM API, verify:
- The ASM integration credentials are active.
- The integration is configured for the requested data.
- The request is being sent to the correct ASM endpoint.
Test with a minimal request
- Confirm the API family and endpoint.
- Confirm the region and base URL.
- Use a lightweight, known-good endpoint.
- Test the credentials using the required authentication method.
- Confirm that the response is successful.
- Test the specific endpoint required by your integration.
Credential security
- Store API keys and Secrets in a secure secrets manager.
- Never include credentials in URLs.
- Do not commit credentials to code repositories.
- Do not share credentials through email, chat, or support tickets.
- Use separate credentials for separate environments where possible.
- Rotate credentials according to your security policy.
- Update all clients immediately after a key or Secret is regenerated.