API documentationIntroduction

Introduction

Authenticate against the RAD Security API, understand token scoping, and find the endpoints for common workflows like user access reviews.

Authentication

The API is authenticated using Session Tokens sent as Bearer tokens in the Authorization header.

  1. Create an access key in Settings → Tenant Access Keys: https://app.rad.security/<your-tenant-id>/<your-account-id>/settings/tenant-access-keys
  2. Create a session token:
curl 'https://api.rad.security/authentication/authenticate' \
-d'{"access_key_id":"<key id>","secret_key":"<secret key>"}'

You'll receive a response similar to the one below:

{"token":"<session token>","expires_at":"2023-03-29T18:02:07.06908577Z"}
  1. Run an API call using a Session token:
curl -H'Authorization: Bearer <session token>' \
'https://api.rad.security/accounts'

Token scope matters. An account-level access key only sees its own account. To work across a whole tenant (for example, listing every account's users), create a tenant-level access key and enumerate accounts with GET /accounts?parent_id=<tenant_id> first.

Common workflow: user access review

Three calls cover a full access review across a tenant:

  1. List the accounts (tenant-level key): GET /accounts?parent_id=<tenant_id>
  2. List each account's users: GET /accounts/{account_id}/users — returns every member with roles, locked, and last_login_at, so dormant and suspended users can be flagged in the same pass.
  3. Drill into one user's roles when needed: GET /accounts/{account_id}/users/{user_id}/roles

See the Accounts & Users section in the sidebar for full request and response schemas.

Was this page helpful?