SAS Management API

The SAS Management API is a management REST API suite for SAS PCE that provides API methods for automating account, token, and user management. On the appliance, it is pre-integrated with SAE for OAuth2 client credentials authentication.

API components

• User management API — Integrates SAS PCE Enterprise Virtual Appliance user management into existing workflows that do not rely on synchronizing a user store. Includes methods for creating, reading, updating, and deleting users; terminating user sessions; and managing authenticators.

Getting started with the SAS Management API

Run sudo sas-mgmt-info command on SAS PCE Enterprise Virtual applinace to view information about the SAS MAnagemnet API.

• Swagger UI URL — http://<appliance-fqdn>:5003/swagger/index.html. Interactive API explorer for the SAS Management API.

• Base API URL — http://<appliance-fqdn>:5003/api/v1. Root path for all REST API calls.

• Health probe URL — http://<appliance-fqdn>:5003/api/v1/health/live. Liveness endpoint for monitoring.

• OAuth2 token URL — https://<appliance-fqdn>/realms/SASManagementAPI/protocol/openid-connect/token. The OpenID Connect token endpoint on SAE that issues access tokens using the OAuth2 Client Credentials grant.

• Grant type — client_credentials.

• Client ID — sas-mgmt. The OAuth2 client on SAE, created by the wizard's SAS Management API bootstrap step.

• Client Secret — The client secret generated for the sas-mgmt client during first boot. Stored in /home/ubuntu/appliance/sas-mgmt-api/.client-secret.

• Tenant code — The SAS PCE tenant code entered during the wizard setup. Required as a path parameter on all /api/v1/tenants/{tenantCode}/... endpoints.

• A ready-to-run curl one-liner that obtains an OAuth2 access token and uses it to call the users endpoint.

• Swagger Authorize instructions — Instructions for authorizing requests in Swagger UI by pasting a bearer token into the Authorize dialog so that endpoints can be invoked from the browser.

• The list of available endpoints exposed by a appliance. For the complete endpoint reference, including methods, paths, and behavior for each route, see Authenticator management API.

Run the command with sudo. Otherwise, the command displays .

Enabling the SAS Management API for additional (child) tenants

The wizard configures the SAS Management API for the primary tenant you entered during first boot. If you create additional child tenants in the SAS PCE Console afterward, follow the step-by-step Admin UI procedure in Setup — add a SAS Management API client for additional tenants. Each child tenant receives its own OAuth2 client (sas-mgmt-<CHILD_TENANT_CODE>) with independent credentials.

Load balancer

For production use, we recommend placing the SAS Management API behind a load balancer or an API gateway. The load balancer is not included with the appliance — you can use any load balancer or API gateway that meets your requirements. For a reference setup using KrakenD, see Load balancer.

Authenticator management API

For the complete endpoint reference, including methods, paths, request and response schemas, and error codes see Authenticator management API.