API Authentication using OAuth
Basic Authentication (username and password) will be deprecated effective March 31, 2027. Basic Authentication will no longer be accepted after this date.
We ask that you review any existing integrations your organization has built or maintains that connect to CMiC APIs and identify any that are currently using Basic Authentication. Those integrations will need to be migrated to OAuth 2.0 prior to the deprecation date to ensure uninterrupted functionality for your customers.
This change is part of our continued commitment to security and modern authentication standards.
To support your migration planning, documentation on OAuth 2.0 with CMiC APIs is available on the CMiC Partner Portal – Partner Playbook.
If you have questions, need additional guidance, or require access to the CMiC Partner Portal – Partner Playbook, please reach out to partnership@cmicglobal.com.
CMiC supports OAuth2 integration by delegating authentication to an external Identity Provider (IdP). After successful authentication, the IdP issues tokens, primarily the access_token, which CMiC expects to receive in order to validate the user’s identity and authorize access.
The API authentication and authorization flow in CMiC comprises of three layers:
- Application Security Layer
- API Security Layer
- Authentication Layer
To learn more on setting up OAuth, go to OAuth.
To learn more on setting up API Security, go to CMiC API Access Setup
1. Application Security Layer
CMiC natively applies business-level security that governs access to applications, programs, and data within the system. This layer determines which authenticated user or service account is permitted to access inside CMiC.
For example, under the User Maintenance screen, administrators can control which users have access to jobs by defining job security groups and assigning jobs to those groups
2. API Security Layer
CMiC API Security enforces endpoint-level authorization using role-based access control (RBAC). After an identity is authenticated, this layer determines which API endpoints and methods (Create, Update, Retrieve, Delete) the user or application is allowed to execute.
This layer is especially important when multiple integrations require different levels of access to the same business object.
3. Authentication Layer
Authentication verifies the identity of the API user or application before access is granted. CMiC supports Basic Authentication or OAuth 2.0 through an external Identity Provider (IdP), such as Azure AD, Okta, or Google.
Authentication verifies identity only. It does not determine what resources or endpoints the identity can access.