Skip to main content
Access Manager is how you decide who reaches your Lerian products and how systems prove who they are before they call a protected API. This guide walks through that setup with the APIs. If you’d rather work visually for the common user and application tasks, use Access Manager via Lerian Console instead.

​
Before you start

First, make sure each product’s route-level Auth client is enabled and configured with an Auth address. Protected routes then expect an Authorization header carrying a valid bearer token.
A product with its Auth client enabled and configured rejects requests without a valid bearer token on its protected routes. This applies even if the endpoint was previously reachable without authentication.
On Lerian Cloud, that token also carries your tenant context, so you never pass tenant identifiers in payloads or headers yourself. With the Identity APIs, the token is also your tenant boundary. List endpoints return only the users, groups, and applications in your tenant. Create, update, and delete operations stay inside it.

​
Human access

Follow this flow when a person needs to access Lerian products.
1

Inspect available groups

Use List Groups to see the groups available in your environment.On Lerian Cloud, the list covers only your tenant. Use the returned group IDs as-is when you create or update users.
2

Review the permission surface

Check each group’s resources and actions before assigning it. Access Manager permissions are evaluated as exact resource-action pairs, such as reports:get, users:patch, or transfers:read.Some products use HTTP-method-style actions, while others use semantic actions such as read, write, create, or process. Use the permissions returned by the API instead of deriving permission names from endpoint paths.
3

Create the user

Use Create a User and assign the correct groups during creation.Group assignment defines what the user can access. For example, assigning a read-only Midaz group lets the user inspect Midaz resources without changing them.
4

Request a user token

Use Request an Access Token with the password grant type.Use the returned access token as the bearer token when the user calls protected APIs.
5

Refresh the token when needed

Use Refresh the Access Token to exchange a valid refresh token for a new access token.

​
User management endpoints

Use these endpoints to maintain human access over time:

​
Machine-to-machine access

When a service, job, or integration needs to call Lerian APIs without a human in the loop, give it its own application.
1

Create an application

Use Create an Application to create credentials for the integration.Each integration should have its own application. This makes credential rotation and access review easier. The response includes the clientId and clientSecret used by Auth in the client_credentials flow. Store the secret at once: later reads of the application do not return it.
2

Review or manage the application

Use List Applications, Retrieve Application Details, or Delete Application when you need to review or remove machine-to-machine access.Identity hides internal applications from the list. On Lerian Cloud, it only returns applications of your tenant.
3

Request an application token

Use Request an Access Token with the client_credentials grant type.Use the returned access token as the bearer token for the integration’s API calls.

​
Application catalog

Identity accepts only application names from its catalog when it creates or deletes machine-to-machine applications. List Available Applications returns the catalog, with the name and display name of each application.

​
Provider setup

Use an email provider when an application needs email delivery for MFA. Browser SSO uses a separate OAuth-provider and SSO-policy configuration. See the Identity service.
  1. Create or review a provider with the Providers API.
  2. Link the provider to the application with Link Provider to Application.
  3. If the application has multiple linked providers, use Set Default Application Provider to select the default provider.
Use the application-provider endpoints when you need to list, update, unlink, or reorder provider links for an application.

​
MFA setup

Use MFA for users who need an additional login verification step.
1

Start setup

Use Initiate MFA Setup on the signed-in user’s own account and selected MFA method.
2

Verify setup

Use Verify MFA Passcode to confirm the method.
3

Enable MFA

Use Enable MFA after setup verification.
4

Manage MFA over time

Use Get MFA Status, Set Preferred MFA Method, or Disable MFA as the user’s access requirements change.
During login, users with MFA enabled may need to complete Initiate MFA Challenge with the MFA token and selected method, then Verify MFA Login, before receiving usable access tokens. Administrative MFA changes use separate administrative operations.

​
User information and session control

Once a user is active, a few endpoints help inspect and control that session. Retrieve User Information returns their OIDC-compatible profile, and Retrieve User Permissions shows the resources and actions they can reach. To end a session, call End User Session with the id_token_hint form field from that session. This endpoint does not select another user by ID.

​
Permission checks

Protected products call Auth with the resource and action they need to enforce. Use Validate User Permission when an integration needs to check an access decision explicitly.
The response tells you whether the authenticated subject is authorized for that resource-action pair.

​
Tenant access rules on Lerian Cloud

On Lerian Cloud, Access Manager resolves your tenant from your token or application. For password grants and SSO, Auth finds the tenant from the user’s email address. A person with accounts in several tenants signs in to their default tenant. If the person has no default tenant, Auth selects one. Use List Own Tenants and Set Own Default Tenant to see the tenants and change the default. Identity accepts a new user, or a change to the email of a user, only when the email domain matches the domain field of your organization. It refuses the request with IDE-0034 when the domain is different or when that field is empty. So don’t add tenant IDs to Identity or Auth payloads unless an endpoint explicitly documents that field. After authentication, bearer-token claims scope normal Identity management and permission calls. Password and client-credentials grants resolve tenant context before a bearer token exists.