> ## Documentation Index
> Fetch the complete documentation index at: https://docs.lerian.studio/llms.txt
> Use this file to discover all available pages before exploring further.

# Access Manager API Reference

<Tip>
  **This section is intended for developers.** If you're looking for a business-level overview of Access Manager, see [Access Manager](/en/platform/access-manager/access-manager).
</Tip>

Access Manager provides two services that work together to handle authentication, authorization, and identity management across the Lerian ecosystem.

Whether you're authenticating users, managing M2M connections, or controlling access permissions, these APIs give you full programmatic control over your security infrastructure.

## API architecture

***

Access Manager is built on two core services, each with its own APIs:

<Columns cols={2}>
  <Card title="Auth APIs" icon="user-unlock" href="/en/reference/access-manager/am-auth-apis">
    Manages authentication flows, tokens, and session control.
  </Card>

  <Card title="Identity APIs" icon="user-tag" href="/en/reference/access-manager/am-identity-apis">
    Manages users, groups, and application credentials.
  </Card>
</Columns>

## API requirements

***

<Danger>
  Once Access Manager is enabled, **all API requests** to Midaz and its plugins require authentication.

  Every request must include an `Authorization` header with a valid Bearer token, or it will be rejected with a `401 Unauthorized` response.
</Danger>

### Request headers

All authenticated requests must include:

```http theme={null}
Authorization: Bearer {access_token}
Content-Type: application/json
```

### Token expiration

* Access tokens expire after **3600 seconds (1 hour)**
* Refresh tokens expire after **24 hours**
* Plan token refresh before expiration to avoid service interruption

## Next steps

***

* Review the [Using Access Manager](/en/platform/access-manager/using-access-manager) guide for workflow examples.
* Learn about [Access Manager Components](/en/platform/access-manager/am-components) architecture.
* Check [Best Practices](/en/platform/access-manager/am-best-practices) for security recommendations.