- Graphwise Platform Documentation
- Graphwise API Endpoints
- API Authorization using OAuth 2.0
API Authorization using OAuth 2.0
25/08/2026
Graphwise API endpoints can be secured with either OAuth 2.0/OIDC or Basic Authentication. By default, both are enabled. This provides seamless compatibility with previous versions of Graphwise.
Note
We strongly recommend using OAuth 2.0 to comply with high security standards. For information on how to disable Basic Authentication, refer to the Disable Basic Authentication section.
By default both authorization methods, OAuth 2.0/OIDC and Basic Authentication, are enabled.
Basic Authentication transports encoded (not encrypted!) credentials in each HTTP request. Graphwise Platform applications need to separately verify them along with the associated access permissions on each request by connecting to the Keycloak server for verification.
OAuth 2.0/OIDC exchanges credentials for a signed JSON Web Token (JWT). This token is then included in HTTP requests to authorize a client without any additional calls to Keycloak initiated by the Graphwise Platform. This means credentials are only sent once over the network respectively whenever the token needs to be replaced.
In the context of service-to-service and machine-to-machine integrations with the Graphwise Platform, the OAuth 2.0 Client Credentials flow stands as the recommended standard. It permits an application to assert its own identity, rather than that of an end user, when requesting access to secured API endpoints.
The subsequent section describes how you can set up a new client in Keycloak, retrieve an access token and authenticate API requests.
Administrators have to configure a confidential client in the Keycloak realm to enable M2M authentication.
Start Keycloak and set up a client as described in the official Keycloak documentation.
During setup go to Capability config where you will
set Client authentication to On
and enable Service accounts roles under Authentication flow.
Save the client and then navigate to the Client scopes tab of the client.
Click on [servicename]-dedicated, then on Add mapper -> By configuration.
Select Group Membership from the list.
Select an appropriate name and set the Token Claim Name to groups and then save the new mapper.
Navigate to the Service account roles tab of the client.
Click Assign role and select and assign the ApiUser role (or ApiAdmin role) for the application(s) you want to connect to.
pptfor Graph Modelingppgsfor GraphSearchextractorfor Extractorgraphragfor GraphRAG...
A link to the service account username is shown above Assign role. Click on this link to open the service account settings.
Navigate to the Groups tab.
Assign groups relevant for the projects you want to access.
Navigate back to the client settings and to the Credentials tab to copy the Client Secret.
To obtain a token send a POST request to the Keycloak token endpoint:
https://[KEYCLOAK_SERVER]/auth/realms/[SERVERNAME]/protocol/openid-connect/token
where you have to replace the following:
[KEYCLOAK_SERVER]with your actual Keycloak URL[SERVERNAME]with your Keycloak Realm Name.
The request must include the following parameters in the body (form encoded):
grant_type- must be set toclient_credentialsclient_id- the identifier of your confidential clientclient_secret- the client secret obtained on the Credentials tab.
The response will contain a JSON body with a field named access_token containing the usable authentication token.
curl --request POST \ 'https://[KEYCLOAK_SERVER]/auth/realms/[SERVERNAME]/protocol/openid-connect/token' \ --header 'Content-Type: application/x-www-form-urlencoded' \ --data-urlencode 'grant_type=client_credentials' \ --data-urlencode 'client_id=[CLIENT_ID]' \ --data-urlencode 'client_secret=[CLIENT_SECRET]'
where you have to replace the following
[KEYCLOAK_SERVER]with your actual Keycloak host name[SERVERNAME]with your exact Keycloak Realm Name[CLIENT_ID]with your exact Client ID assigned to your application in Keycloak[CLIENT_SECRET]with the private cryptographic key assigned to your application by Keycloak.
{
"access_token": "your_example_token",
"expires_in": 300,
"refresh_expires_in": 0,
"token_type": "Bearer",
"not-before-policy": 0,
"scope": "email profile"
}Once obtained the access token must be included as the Authorization header with the prefix Bearer for all subsequent API calls to the platform. For example, to list all projects use
curl --request GET \ 'https://[GWP_SERVER]/PoolParty/api/projects' \ --header 'Authorization: Bearer [ACCESS_TOKEN]'
where
[GWP_SERVER]should be replaced with your actual server URL[ACCESS_TOKEN]should be replaced with your active OAuth token.
Tip
PoolParty has been rebranded to Graph Modeling as of version 10.2.
Rebranding however has not yet been applied to the URLs used to access the Graphwise endpoints.