Skip to main content

Authenticating a Session in Postman

Before you make an API call from Postman, you must authenticate a session by sending a POST request to Authentication Service's token endpoint and obtaining an authorization token (i.e., bearer access token) in exchange for the API client credentials. The Postman collection provided by Zscaler is prebuilt with the authorization request and associated configurations, simplifying the process of getting access tokens. In addition, authorization is configured at the collection level, which allows you to get the access token once and automatically use it for all requests in the collection.

NOTE
  • The authorization request and token configuration use variables such as authServiceBaseUrl, clientID, and clientSecret, so ensure that you have configured these variables with appropriate values before sending the request. To learn more, see Setting Up Variables and Environments above.
  • The instructions in this section follow the client secret flow of authentication which is supported by the Postman application. The other method of authentication that you can use for OneAPI, Private Key JWT authentication, is not supported by Postman.

To send an authorization request to retrieve the access token:

  1. In the workspace where you added your collection, go to Collections.

  2. Click the OneAPI collection folder name.

  3. Go to the Authorization tab displayed for the collection.

  4. Review the authorization details that are prepopulated for the OAuth 2.0 authentication type and verify the token configuration details.

    Under Advanced, ensure that the audience parameter configured with the value https://api.zscaler.com is selected for both Token Request and Refresh Request.

  5. If you are using an environment for your variables, ensure that the correct environment is selected in the top-right corner.

  6. After verifying the authorization details, click Get New Access Token.

    If authentication is successful, an access token is returned and appears in a window. This window displays the complete token details, such as the access token, token type (i.e., bearer token), token expiration, etc.

  7. (Optional) Rename the token for easy identification using the Token Name field in the window.

  8. To use the access token in your API requests, click Use Token in the window.

  9. On the Authorization tab, the access token name is selected in the drop-down menu and the token is populated in the Token field under Current Token.

    When the access token is selected for use, the Auto-refresh Token option is automatically enabled.

This authorization token is automatically passed onto each request made from the collection to the OneAPI resources.