Access tokens

Making API calls¶

Before you make any API calls, you must create a service principal and authenticate with Sophos Central. Our APIs use OAuth2, a popular and secure authentication mechanism used with many public APIs.

Creating a service principal¶

Partners can create a service principal through Sophos Central Partner. See the Partner Getting Started guide for details.

Organizations can create a service principal through Sophos Central Enterprise. See the Organization Getting Started guide for details.

Tenants can create a service principal through Sophos Central Admin. See the Tenant Getting Started guide for details.

Authentication¶

A service principal must authenticate with Sophos ID, our Identity Provider (IDP), to acquire a time-limited and scope-limited authentication token. These tokens follow the JSON Web Token (JWT) standard.

To obtain a JWT token, make a POST request to Sophos ID passing in the Client ID and the Client Secret for the service principal. As a cURL command:

curl -XPOST -H 'Content-Type:application/x-www-form-urlencoded' \
            -d 'grant_type=client_credentials&client_id=<id>&client_secret=<secret>&scope=token' \
                   https://id.sophos.com/api/v2/oauth2/token

The command has been split across multiple lines for legibility. Replace <id> with your Client ID and <secret> with your Client Secret.

The JWT token returned by Sophos ID must be passed in the Authorization header for subsequent API calls. The header should look as follows:

Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0
                      NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5M
                      DIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c

The header above has been split across multiple lines and indented for legibility.