API security protocols maintained by Saviynt

[Diptansu1]

Hello Team , 

Recently our customer asked us to specify API security or protocols maintained by Saviynt while doing any API integration.

Please provide information on this at the earliest. Preferably if there is any specific standard/protocol can be mentioned .

[Rishi · Accepted solution]

@Diptansu1 We are creating a knowledge article to provide a detailed view of API security. However at high level following are the key features:

• Saviynt utilized JWT token for authentication, which is based on RFC6750
• The encrypted used is AES256
• The token gets expired after default 1 hour but the expiration duration is configured
• Token can be generated using service account Or by making use of Refresh token. Refresh token can also be configured to expire after sometime
• The token must be present as Bearer token to call any Saviynt API
• The access to API can be controlled based on the SAV role linked to the service account. That means access will be controlled to only to the APIs that are configured in the SAV role.
• The account and entitlement related APIs can further be access controlled to only the endpoints which are configured in the SAV role
• Once the token is expired, a new token needs to be generated to access the APIs