canonical: https://jentic.com/apis/mitel.io/mitel # Mitel CloudLink Platform Auth API The Mitel CloudLink Platform Auth API is the OAuth 2.0 token service that fronts Mitel's CloudLink communications platform. It issues access and refresh tokens for users, clients, and guests, supports password, client_credentials, refresh_token, authorization_code, and token-exchange grants, and provides assume-role and SAML2 flows for cross-account administration. Use it to obtain bearer tokens for downstream CloudLink microservices, manage registered application clients, and run policy tests against a user's access scope. ## For AI agents Issue and refresh OAuth bearer tokens for the Mitel CloudLink platform, including assume-role, guest, and SAML2 flows. Manages registered application clients and policy tests. ## Scope Does not handle voice calls, messaging, or contact-center routing - use for Mitel CloudLink OAuth token issuance and client management only. ## Capabilities - Issue access and refresh tokens via OAuth password and client_credentials grants - Refresh expired access tokens without re-prompting the user - Run authorization_code flows for browser-based application logins - Issue guest tokens with limited scope for unauthenticated use cases - Switch account or role with assume-role token issuance - Register and manage application clients in the CloudLink directory - Run policy tests to check whether a user can access a resource ## Use cases ### Application Login for CloudLink Apps Browser and mobile applications redirect the user to the Mitel auth portal, which posts the user's credentials to /authorize and returns an authorization code. The app exchanges the code at /token for an access token plus a 14-day refresh token. From there, the app can call any downstream CloudLink microservice with the bearer token. Example prompt: Exchange authorization code {code} for tokens by calling POST /token with grant_type authorization_code and client credentials ### Server-to-Server Service Calls Backend services authenticate to CloudLink with client credentials to obtain a service-scoped access token that is used across downstream microservices. Tokens default to one hour and are refreshed silently. The same flow supports basic-auth header encoding when the service prefers HTTP basic over body parameters. Example prompt: Call POST /token with grant_type client_credentials and your client_id and client_secret to retrieve a service token ### Cross-Account Admin Switch A partner administrator who manages multiple tenants uses the assume-role endpoint to issue a fresh token in a target account and role. This avoids logging out and back in when working across tenants and lets administrators temporarily downgrade themselves to USER role for safer testing. Example prompt: Call POST `/assume-role/token` with body { accountId: 1234, role: USER } using the admin's existing bearer token ### Agent-Driven Token Management An automation agent discovered through Jentic obtains and rotates CloudLink tokens for downstream calls. Jentic stores the long-lived client_secret in its credential vault and the agent only invokes the token issuance operation, so refresh and assume-role flows can run without leaking the underlying secret. Example prompt: Use Jentic to find the Mitel token operation, execute the client_credentials grant, and cache the returned access token for downstream calls ## Key endpoints | Method | Path | Description | | --- | --- | --- | | POST | `/token` | Issue access and refresh tokens via OAuth grants | | POST | `/guest/token` | Issue a guest token for anonymous flows | | POST | `/assume-role/token` | Switch account or role with a fresh token | | POST | `/authorize` | Initiate the authorization code grant flow | | GET | `/saml2/start` | Initiate SAML2 single sign-on | ## Key resources - **token** — Issue access and refresh tokens for OAuth 2.0 grants - **guest token** — Issue limited-scope tokens for anonymous flows - **assume-role token** — Switch account or role with a fresh token - **authorize** — Authorization code grant initiation - **applications** — Manage the registered application client directory - **saml2** — SAML2 federation endpoints ## Why Jentic - **Setup:** Wiring Mitel CloudLink by hand means running its OAuth2 grant flows against authentication.api.mitel.io, managing client_id and client_secret, and handling token refresh and assume-role exchanges yourself. Through Jentic you install once, import Mitel CloudLink from the API Directory, store the credentials once, and your agent calls it. - **Permission scoping:** CloudLink's token and authorize endpoints carry the grant details in the request body rather than a URL path resource, so scope the agent to the operations it needs, such as issuing a token or refreshing one. You choose which operations are allowed, so the assume-role token exchange is only included if you add it. - **Credential handling:** Your CloudLink client_id, client_secret, and user passwords are stored once, encrypted, by your own Jentic One instance, and only the short-lived access token is surfaced for downstream calls. They never enter the agent's prompt, logs, or context. - **Discovery method:** Agents search Jentic by intent such as 'get a CloudLink token' or 'refresh an access token', and Jentic returns the matching grant-specific operation with its input schema so the agent calls the right endpoint without browsing the reference docs. ## Related APIs - **Auth0 Management API** — OAuth and identity platform from Okta - **Okta Management API** — Identity, SSO, and OAuth from Okta - **RingCentral API** — Cloud telephony and team messaging APIs ## FAQ ### What authentication does the Mitel CloudLink Auth API use? The API itself issues OAuth 2.0 tokens, so it accepts grant-specific credentials at POST /token: username and password for the password grant, client_id and client_secret for client_credentials, or an authorization code for the auth code grant. Through Jentic the long-lived secrets are held in the credential vault and only the issued bearer token leaves the vault for downstream calls. ### Can I refresh an expired CloudLink access token? Yes. Call POST /token with grant_type refresh_token and the refresh_token value. Access tokens default to 1 hour and refresh tokens to 14 days, so refresh proactively before expiry to avoid 401 responses on downstream microservice calls. ### What are the rate limits for the Mitel CloudLink Auth API? Mitel applies per-client and per-account rate limits to the token endpoints to prevent credential stuffing. Tight loops on /token will be throttled. Cache issued tokens for their full lifetime rather than re-issuing per request. ### How do I issue a CloudLink token through Jentic? Search Jentic for issue cloudlink token, load the schema for POST /token, and execute with grant_type client_credentials and your client_id and client_secret. The returned access token is then used as the bearer for any downstream CloudLink microservice. ### Does the Mitel CloudLink Auth API support SAML federation? Yes. The /saml2 endpoints initiate SAML2 SSO and consume IdP responses. Use them when the customer's CloudLink account is federated to an external identity provider rather than relying on local username and password. ### Can I switch an admin into a different account without re-login? Yes. Call POST `/assume-role/token` with a JSON body specifying accountId and the desired role. Permissions allowing, the response is a fresh token scoped to the new account, avoiding a full logout and login cycle. ### Can I limit what my agent is allowed to do with the Mitel CloudLink Auth API? Yes. Because you run Jentic One yourself, your own rules decide which of the CloudLink token operations the agent may call, so you can allow it to issue a token via POST /token or refresh one, while leaving out others. The grant details travel in the request body rather than a URL path, so the assume-role exchange at POST `/assume-role/token` is included only if you choose to add it. Your client_id and client_secret stay in your self-hosted instance, and only the short-lived access token is surfaced for the calls you permit.