Authenticating your API

Before you can call a Boomi API, you need valid credentials for the service area you plan to use. Most Boomi service areas share the same Platform API authentication model. Two service areas, Data Integration and Managed File Transfer (MFT), use their own authentication methods.

Service area	Authentication method
Platform REST API, Platform SOAP API, Platform Partner API	Platform API authentication
Connector APIs	Platform API authentication
Agentstudio APIs	Platform API authentication
Data Hub Platform API	Platform API authentication (Basic Auth)
Data Hub Repository API	Platform API authentication (JWT)
Bundles APIs	Platform API authentication (API key or JWT)
Audit Log Staging APIs	Platform API authentication (JWT)
Event Notifications APIs	Platform API authentication (JWT)
GraphQL APIs	Platform API authentication (JWT)
Meta Hub APIs	Platform API authentication (JWT)
Data Integration APIs	Data Integration API authentication (its own bearer token)
Managed File Transfer (MFT) APIs	MFT API authentication (its own user token or API key)

Platform API authentication

Platform REST, SOAP, and Partner APIs, along with the majority of other Boomi service areas, authenticate using one of the following methods:

• User name and password credentials - Single sign-on (SSO) Administration users and regular (non-SSO) users can authenticate using their user name and password in a Basic Auth type authorization.
• Boomi Enterprise Platform API tokens - SSO users without Administrator privileges, and users with two-factor authentication (2FA) enabled, authenticate using an API token generated from Settings > Account Information and Setup > Boomi Enterprise Platform API Tokens. Use the token value in place of a password, with a user name in the form BOOMI_TOKEN.<username>.
• Two-factor authentication (2FA) - For ad hoc calls on 2FA-enabled accounts, include the X-Boomi-OTP header with a time-based one-time password (TOTP) code.
• JWT authentication tokens - Several service areas, including GraphQL, the Data Hub Repository API, Event Notifications, Audit Log Staging, Meta Hub, and Bundles, authenticate using a JWT bearer token. Generate a JWT with a Basic Auth GET request to https://api.boomi.com/auth/jwt/generate/{accountId} (or the equivalent GB endpoint), then send it as Authorization: Bearer <JWT>. JWT tokens expire after 5 minutes.

For the complete reference, including request examples and regional base URLs, refer to Platform API and Partner API authentication.

Data Integration API authentication

The Data Integration API uses its own Bearer token, separate from Platform API credentials.

Every Data Integration API token is a combination of account, environment, and attached scopes. A scope combines a Data Integration entity (such as connection) with an allowed operation (such as list or edit). When you make a request, the API compares the token's scopes with the scope the request requires; a mismatch returns a 403 (insufficient permissions) response.

To generate a Data Integration API token, refer to the Data Integration API overview on Help Docs.

MFT API authentication

The MFT API uses either a user-generated token or an API key, managed from the MFT portal.

• User token - Generate a token by calling POST /api/Users/authenticate from the regional Swagger page (or an external script) with your user name, password, and MFA code (if enabled). Use the returned token as a bearer token; it expires in 10-15 minutes, so use the refresh token to extend the session.
• API key - Create an API key under your user profile in the MFT portal, optionally scoped to specific organizations, permissions, and an expiration date. Send the key using the ApiKey header.

For step-by-step instructions, refer to Authentication for AFT REST APIs.

Next steps

Once you have valid credentials, refer to Call your API to send your first request.