Admin API

Manage your organization from your own code. Create a service app, get a token with client credentials, and call the API with the operations you granted.

The Admin API is the hub, as an API. A service app acts on its own behalf, in its own organization, with the operations you grant it, and every action it takes is recorded in your audit log as that app.

Get a token

Create a service app in the hub, grant it the operations it needs, then exchange its client ID and secret (sent as HTTP Basic authentication) for a token at the token endpoint:

curl https://id.trustaige.com/oauth2/token \
  -u "$CLIENT_ID:$CLIENT_SECRET" \
  -d grant_type=client_credentials \
  -d 'scope=users:read groups:manage'

What a service app can be granted

Operation	Lets the app
`users:read`	Read people
`groups:manage`	Manage groups and their members
`apps:manage`	Manage apps and assignments
`audit:read`, `audit:export`	Read and export the audit log
`analytics:read`	Read analytics
`access_requests:read`, `access_requests:approve`	Read and approve access requests
`entitlements:view`	View entitlements
`webhooks:manage`	Manage webhooks
`ssf:manage`	Manage Shared Signals receivers and streams

Other operations, such as managing roles, billing or the vault, are never grantable to a program.