Register an App for API Access

https://identity.sp4c.storage-defender.ibm.com/connect/token

• Content-Type: application/x-www-form-urlencoded

• client_id: Copy the application (client) ID from the app registration.
• client_secret: Copy the saved client secret from the app registration.
• scope: Set the scope, which is the assigned permission.
• grant_type: Set to client_credentials.
  Request sample for getting access token by client secret:

  POST https://identity.sp4c.storage-defender.ibm.com/connect/token
  Content-Type: application/x-www-form-urlencoded
  client_id=edbdd4fa-0733-4cac-8a43-af4df3e97756
  &scope=audit.read.all
  &client_secret=3ZxGsm...wNG8wFrzY
  &grant_type=client_credentials

• access_token: The token value.
• expires_in: Indicates the token expiration in seconds.
  Response sample:

  { "token_type": "Bearer",
  "expires_in": 3600,
  "ext_expires_in":3600,
  "access_token": "eyJhbGciOiJSUzI1NiIsImtpZCI6IkQ2MzA1NzRFRDdDRDdBR..." }

  Note: You can use Postman to test the POST request as described above.

dotnet new console -o SP4CPublicApiTokenSample --framework net6.0
cd ./SP4CPublicApiTokenSample
dotnet add package System.IdentityModel.Tokens.Jwt --version 6.30.1

using System.IdentityModel.Tokens.Jwt;
using System.Net.Http.Json;
using System.Security.Claims;
using System.Security.Cryptography.X509Certificates;
using System.Text.Json.Serialization;
using Microsoft.IdentityModel.Tokens;


// Set your app registration information and certificate here
const string CLIENT_ID = "YOUR_CLIENT_ID"; // Application (Client) ID
const string SCOPES = "YOUR_SCOPE"; // Permission, e.g., "audit.read.all"
const string CERTIFICATE_PATH = "YOUR_CERTIFICATE_PATH"; // Path to .pfx or .pem file
const string CERTIFICATE_PASSWORD = "YOUR_CERTIFICATE_PASSWORD";


const string IDENTITY_SERVICE_URI = "https://identity.sp4c.storage-defender.ibm.com/connect/token";
const string AUDIENCE = "https://identity.sp4c.storage-defender.ibm.com/connect/token";


var clientAssertionValue = GenerateClientAssertion();
var token = await GetToken(clientAssertionValue);


PrintToken(token);


static string GenerateClientAssertion()
{
var certificate = new X509Certificate2(CERTIFICATE_PATH, CERTIFICATE_PASSWORD);
var signingCredentials = new X509SigningCredentials(certificate);


var claims = new List<Claim>()
{
new Claim("jti", Guid.NewGuid().ToString()),
new Claim("sub", CLIENT_ID)
};


var jwtSecurityToken = new JwtSecurityToken(
CLIENT_ID,
AUDIENCE,
claims,
DateTime.Now,
DateTime.Now.AddHours(1),
signingCredentials);


var clientAssertionValue = new JwtSecurityTokenHandler().WriteToken(jwtSecurityToken);
return clientAssertionValue;
}


static async Task<SP4CTokenResponse?> GetToken(string clientAssertionValue)
{
var requestContent = new FormUrlEncodedContent(new Dictionary<string, string>
{
{"grant_type", "client_credentials"},
{"client_assertion_type", "urn:ietf:params:oauth:client-assertion-type:jwt-bearer"},
{"client_assertion", clientAssertionValue},
{"scope", SCOPES},
});


try
{
var client = new HttpClient();
var response = await client.PostAsync(IDENTITY_SERVICE_URI, requestContent);


if (response.IsSuccessStatusCode)
{
var token = await response.Content.ReadFromJsonAsync<SP4CTokenResponse>();
return token;
}
else
{
throw new Exception($"Status code: {response.StatusCode}, Raw content: {await response.Content.ReadAsStringAsync()}");
}
}
catch (Exception ex)
{
Console.WriteLine($"Get token failed: {ex}");
return null;
}
}


static void PrintToken(SP4CTokenResponse? token)
{
if (token == null)
{
return;
}


Console.WriteLine("[Access Token]");
Console.WriteLine(token.AccessToken);
Console.WriteLine("[Scope]");
Console.WriteLine(token.Scope);
}


class SP4CTokenResponse
{
[JsonPropertyName("access_token")]
public string? AccessToken { get; set; }


[JsonPropertyName("expires_in")]
public int ExpiresIn { get; set; }


[JsonPropertyName("token_type")]
public string? TokenType { get; set; }


[JsonPropertyName("scope")]
public string? Scope { get; set; }
}

dotnet run

[Access Token]
eyJhbGc...
[Scope]
audit.read.all