# mulesoft Access Management - Full Documentation --- product: Access Management version: master keywords: anypoint platform, permissions, configuring --- # Access Management Overview > For the full documentation index, see: https://docs.mulesoft.com/llms.txt Access Management is the central hub for managing user access, authentication, and permissions across your Anypoint Platform organization. Use Access Management to [create your Anypoint Platform account](https://docs.mulesoft.com/access-management/managing-your-account#how-to-create-your-account) and configure your user profile. Organization owners and administrators can use Access Management to: - [Invite and manage users](https://docs.mulesoft.com/access-management/users) in your organization. - Create [business groups](https://docs.mulesoft.com/access-management/business-groups) to contain your Anypoint Platform resources such as apps and APIs. - Create [environments](https://docs.mulesoft.com/access-management/environments) to manage app and API deployment. - [Assign permissions to individual users](https://docs.mulesoft.com/access-management/managing-permissions) or set up hierarchical user management by using the [Teams](https://docs.mulesoft.com/access-management/teams) feature to manage access to assets and areas of your organization. - Manage user identity and configure single sign-on (SSO) by using [external identity providers (IdPs)](https://docs.mulesoft.com/access-management/external-identity). - Protect your organization from unauthorized access by using [multi-factor authentication](https://docs.mulesoft.com/access-management/multi-factor-authentication). - Authorize client applications by configuring [external client providers](https://docs.mulesoft.com/access-management/managing-api-clients). - View user and connected app activity by using [audit logs](https://docs.mulesoft.com/access-management/audit-logging). - Develop and configure [connected apps](https://docs.mulesoft.com/access-management/connected-apps-overview) to delegate access to Anypoint Platform. - Grant [external organizations](https://docs.mulesoft.com/access-management/external-organization-access) access to your resources to enable cross-organization collaboration. Access Management also provides a REST API for you to programmatically access the resources related to user and client management, organizations and business groups, and roles and permissions. To use the Access Management API, see the [Access Management API Portal](https://dev-portal.mulesoft.com/apis/access-management.html). Depending on your [Anypoint Platform deployment type](https://docs.mulesoft.com/hosting-home/), some Access Management features may be unavailable to your organization. For example, account creation and user invitation from Anypoint Platform isn’t available for Anypoint Platform Private Cloud Edition. Certain features are also unavailable for MuleSoft Government Cloud. Organization administrators can contact your MuleSoft Account Team for help with your account. If you’re not an administrator, contact your organization administrator. ## See Also - [Create Your Account](https://docs.mulesoft.com/access-management/managing-your-account#how-to-create-your-account) - [Managing Users](https://docs.mulesoft.com/access-management/users) - [Permissions in Anypoint Platform](https://docs.mulesoft.com/access-management/managing-permissions) - [Using Teams to Manage User Permissions](https://docs.mulesoft.com/access-management/teams) - [Using Roles to Manage Permissions](https://docs.mulesoft.com/access-management/roles) - [Access Management API Portal](https://dev-portal.mulesoft.com/apis/access-management.html) --- product: Access Management version: master --- # Access Management Release Notes > For the full documentation index, see: https://docs.mulesoft.com/llms.txt The following release notes detail new features and fixed issues in the Access Management section of Anypoint Platform: [Anypoint Access Management Release Notes](https://docs.mulesoft.com/release-notes/access-management/access-management-release-notes) ## See Also - [Access Management Overview](https://docs.mulesoft.com/access-management/) - [Known Issues](https://help.salesforce.com/s/issues) --- product: Access Management version: master --- # Allowlisting Trusted Domains in Anypoint Platform > For the full documentation index, see: https://docs.mulesoft.com/llms.txt Register trusted domains to allow HTTP requests to external resources through the API Console proxy. Anypoint Platform requires domain registration before making secure calls to third-party services. ## Add a New Trusted Domain The new domain must not duplicate an existing trusted domain and can’t be a MuleSoft or Anypoint Platform domain or subdomain. 1. Sign in to Anypoint Platform using an account that has the Organization Administrator permission. 2. Select **Access Management** from the ![gear icon](/mulesoft/current/en-us/access-management/_images/gear.svg) menu. 3. Click **Trusted domains**. 4. Click **Add domain**. 5. In the dialog box, enter the domain name and click **Add domain**. You are redirected to the Trusted Domains page, where you can edit or delete domains. If you register a domain on a parent organization, it’s also allowlisted on all business groups. ## Automatic Registration of Domains Some domains are added automatically: - Publishing an API specification to Exchange adds the implementation base URI. - Sending a request through the proxy adds the implementation base URI. - Unauthenticated requests from public Exchange portals or Mocking Service shareable links are added. > [!NOTE] Public Anypoint Exchange assets and portals created before 2024 aren’t always > automatically registered. Manually register those domains. ## See Also - [Managing IP Allowlists in Access Management](https://docs.mulesoft.com/access-management/managing-ip-allowlists) - [Managing Security Settings](https://docs.mulesoft.com/access-management/managing-security-settings) - [Allowlist URLs to Sign in to and Use Anypoint Platform](https://docs.mulesoft.com/access-management/managing-your-account#allowlist-urls) --- product: Access Management version: master keywords: anypoint platform, permissions, configuring, limits --- # Anypoint Platform Access FAQs > For the full documentation index, see: https://docs.mulesoft.com/llms.txt ## Access and Administration For complete information on user permissions, see [Permissions Available in Anypoint Platform](https://docs.mulesoft.com/access-management/permissions-by-product). ### Who can access Access Management? Users who have the Organization Administrator permission over their root organization or business group have view and edit permissions in Access Management. Users who are team maintainers can also access Access Management, although their actions within Access Management vary based on their other permissions. ### Who can access audit logs? Users who have the Audit Log Viewer permission can view audit logs in Access Management even if they lack administrator permissions. For more information, see the [audit logs documentation](https://docs.mulesoft.com/access-management/audit-logging#access-audit-logging). ### Who can modify connected apps? Only users who have the Organization Administrator permission over the root organization can view and edit connected apps. Users with administrative permissions over business groups (and not the root organization) cannot view or edit connected apps. Some features in Access Management cannot be accessed using any connected app scopes or permissions. These features are available only using the user interface on the web or using a bearer token generated by an authenticated user who has the Organization Administrator permission over their root organization. For more information, see the [connected apps documentation](https://docs.mulesoft.com/access-management/connected-apps-overview#access-and-authorization). ## Limits Access Management imposes the following limits on features in an organization: ### Organization Limits - Business groups per root organization: 100 - Users per root organization: 10,000 - Environments per root organization or business group: 150 - External access relations per root organization: 20 - Permissions per external organization: 1000 - Audit log retention period: Between 30 and 2190 days ### Teams, Roles, and User Permissions Limits - Teams per root organization: 1000 - Levels nested under parent teams: 10 - Permissions per team: 1000 - Permissions per API Manager client or runtime client: 3000 - Permissions per custom role: 400 - Permissions per user: 5000 - Roles per root organization or business group: 500 - Roles per user: 700 - External group mappings per team: 100 ### Identity Providers Limits - Identity management provider keys per provider: 3 - Identity management providers per root organization: 25 ### Client Providers Limits - Client management providers per root organization: 25 ### Client Limits - Clients per root organization: 10,000 The client limit applies to all Anypoint Platform clients in your org (for example, API Manager client applications, Runtime Manager clients, and other service clients). Not all clients appear in the API Manager UI. To view the client count, use the Access Management API endpoint `GET [https://anypoint.mulesoft.com/accounts/api/organizations/{orgId}/clients](https://anypoint.mulesoft.com/accounts/api/organizations/{orgId}/clients)`. ### Connected Apps Limits - Authorized applications per user: 30 - Connected apps accessible by external organizations: 20 - Connected apps per root organization: 2000 - Scope assignments per connected application: 1000 ### User Token Limits - Active tokens per user in Gov Cloud: 100 - Active tokens per user in EU Region: 100 ## Accounts ### Can I create multiple accounts with one email address? You can create multiple accounts using the same email address, whether the accounts belong in one organization or in different organizations. Your username must be unique for each account. ### How do I join an existing organization? To join an existing organization, contact an Organization Administrator for the organization that you need to join and ask them to send you an invitation to that organization. Once you receive your invitation, you can create a new account to accept the invitation and associate your account with the organization. > [!NOTE] Any data that you entered into an organization from an account that you created yourself > remains associated with the old organization. ### How do I find billing information for my account? Talk your account representative, or use [the MuleSoft contact form](https://www.mulesoft.com/contact) to obtain billing information. ### What can I do if my trial is about to expire? Talk to your account representative or use [the MuleSoft contact form](https://www.mulesoft.com/contact) to request an Enterprise license for your on-premises Mule Runtime instances or to create a subscription account on CloudHub. ### Where do I sign in with external identity management? If your organization uses external identity management, sign in to your account at **anypoint.mulesoft.com/accounts/login/_yourorganizationname_**. ### How do I delete my account? Create a MuleSoft support case from [Salesforce Help](https://help.salesforce.com) for account deletion or migration. ## Account Invitations ### What account should I use? If existing MuleSoft community accounts are associated with the email address where you received your invitation, MuleSoft prompts you to use your existing account to sign in and accept the invitation. You can also create a new account by clicking the **Sign Up** link at the bottom of the form. ### How can I use a different email address? Accept the invitation using the email where it was sent. After you’ve accepted the invitation, visit your profile to change your email address. ### Why can’t I see anything? If you accept an invitation, sign in, and can’t see anything on your organization’s Developer Portal, one of the following might be affecting your view: - No one in your organization has added any APIs yet, and thus there are no API Portals to display. - You haven’t been granted **Portal Viewer** access to any private API Portals, and there are no public API Portals to display. ## API Access ### How do I grant access to my API Version? To give others access to your API Version, you must be the **API Version Owner**, and they must be a member of your organization. 1. Navigate to your API Version Details page. 2. Click the **Permissions** tab. 3. Invite a user to access your API, if that user is a member of the same organization as you. 4. Once you add a user, you can manage **Portal Viewer** access or **API Version Owner** access using the drop-down in the **Permission** column. This tab also enables you to view all users who have been granted direct permissions to your API. > [!NOTE] The **Permissions** tab doesn’t display any users with permissions based on a custom > role because roles can’t be managed from API Version Details pages. Contact your > **Organization Administrator** for information about role-based permissions to your API > version. ### How do I browse Developer Portals? Sign out of your account to browse Developer Portals for other organizations. While you are signed into your own organization, you can access only your own organization’s Developer Portal. > [!NOTE] To request access to an API that belongs to a different organization, you need to have an > Anypoint Platform account for that organization. ### How can I request access to an API? If you’re not a member of the organization that owns an API that you want to use: - Sign in using an account in the organization that owns the API. - If you don’t have an account with the organization, review the documentation in the API Portal for information about how to request an account. ### See Also - [Troubleshoot Access Management](https://docs.mulesoft.com/access-management/troubleshoot-access-management) - [Permissions by Product](https://docs.mulesoft.com/access-management/permissions-by-product) - [Access Audit Logs](https://docs.mulesoft.com/access-management/audit-logging#access-audit-logging) - [Connected Apps Access and Authorization](https://docs.mulesoft.com/access-management/connected-apps-overview#access-and-authorization) ## See Also - [Known Issues](https://help.salesforce.com/s/issues) --- product: Access Management version: master --- # Anypoint Platform Business Groups > For the full documentation index, see: https://docs.mulesoft.com/llms.txt Use business groups to organize resources like applications and APIs into self-contained groups within Anypoint Platform. Business groups provide granular control over user access to those resources. When you create an Anypoint Platform account, a root organization (business group) is created, and you become its owner and have the Organization Administrator permission. A root organization is a single instance of Anypoint Platform that includes all the entitlements, features, and capabilities you purchased. The root organization can contain multiple business groups. Multiple users in the root organization can share resources, such as applications and environments. Access to resources is determined by assigned user roles and permissions. For example, one user can manage API alerts, while another can only view them. > [!NOTE] Business groups are not enabled by default in a new Anypoint Platform account. To activate > business groups in your organization, contact your MuleSoft representative. Organizations can have > a maximum of 100 business groups. Within the root organization, business groups are arranged hierarchically. The root organization functions as the top-level business group, and each created business group has a single parent and can have multiple child business groups. ## Organization Owner The user who first signs up for an Anypoint Platform account is designated as the organization owner. The organization owner is automatically granted the Organization Administrator permission. This is not a permission that is assigned, rather it is an identifier for this single user (creator of the Anypoint Platform account). When ownership of an organization is transferred to another user, the original organization owner retains the Organization Administrator permission unless you explicitly revoke it. ## Business Group Ownership Every business group created within the organization hierarchy must have an owner with the Organization Administrator permission assigned. Any organization administrator can assign and change owners of business groups. A business group can have only one owner. ## Permissions and Roles in Business Groups Because business groups are hierarchical, the owner of a parent business group automatically has and retains administrator permissions for any child business group of that parent, even if a different organization administrator owns the child business group. Conversely, owners of child business groups can’t: - Access or modify the parent business group’s or root organization’s settings - View the parent business group’s client ID and client secret When you create a business group under another business group, only the redistributable entitlements, such as VPCs and load balancers, that were assigned to the parent business group can be allocated to the child business group. Permissions and roles are applied at both the root organization and individual business group levels, but control access to different resources at each level. Permissions and roles assigned to a user in one business group don’t apply to that user’s access in other business groups. To interact with a business group, a user must have a permission granted within that group or be a member of a team with permission in that group. All users belong to the root organization, regardless of business group membership. As a member of a business group, you are automatically granted permissions to view and access the business group, but to access certain resources, you must have the appropriate permissions or roles assigned to you. For example, to access APIs and CloudHub deployments in the business group, you must be assigned permissions that apply to that business group. For example: - If you have the Organization Administrator permission in BusinessGroupA, you can grant users and teams access to APIs and CloudHub deployments within BusinessGroupA. - That same permission in BusinessGroupB doesn’t allow you to grant access to APIs and CloudHub deployments in BusinessGroupA. Resources that belong to the root organization require permissions specified at the root organization level. Users with Organization Administrator permission at any level automatically have that permission in any child business group created within that level. This permission inheritance is not retroactive; it doesn’t apply to users who gain Organization Administrator permission **after** a child group is created. ### Organization Administrator Capabilities An Anypoint Platform user who has the Organization Administrator permission can perform these types of tasks: - Invite users to an organization. - Assign users to teams or roles that define their permissions in Anypoint Platform. - Edit and remove users from an organization. - Assign or change owners of business groups. - Configure organization settings. - Create and manage teams. - View a client ID and client secret for the root organization, business groups, and environments. - Access analytics for the APIs in your organization. - Create business groups to delegate management of the resources and define the scopes of roles and permissions. - Configure additional properties at the business group level. ### See Also - [Managing Business Groups in Anypoint Platform](https://docs.mulesoft.com/access-management/managing-business-groups) - [Teams](https://docs.mulesoft.com/access-management/teams) - [Roles](https://docs.mulesoft.com/access-management/roles) - [Users](https://docs.mulesoft.com/access-management/users) --- product: Access Management version: master --- # Anypoint Platform Connected Apps for Developers > For the full documentation index, see: https://docs.mulesoft.com/llms.txt Use Anypoint Platform Connected Apps to delegate access to applications, build CI/CD pipelines, and extend platform functionality using OAuth 2.0 and OpenID Connect. Developers can allow users to sign in with Anypoint Platform and control client access through an application allowlist. Anypoint Platform provides a [comprehensive set of APIs](https://dev-portal.mulesoft.com/apis/access-management.html) to extend functionality. The Connected Apps feature enables you to: - Delegate access to applications that use APIs to interact with Anypoint Platform programmatically. - Build CI/CD pipelines or productize additional third-party use cases on top of Anypoint Platform. - Enable or disable clients and view client usage. For example, you can see how many organizations are using the app and how many users have access. ## Authentication The Connected Apps feature supports OAuth 2.0 and OpenID Connect, so make sure your app can use tokens to request access to user data. See the information in the OpenID configuration [discovery endpoint](https://anypoint.mulesoft.com/accounts/api/v2/oauth2/.well-known/openid-configuration) to find the supported OpenID Connect capabilities. To make the authentication experience consistent for end users, third-party developers with their own websites or web apps can allow users to sign in using the **Sign in with Anypoint Platform** option. ## Application Allowlist Organization administrators can enable an allowlist to control which apps can access the organization’s user data. When your app is added to an allowlist, only the set of scopes associated with the app are reviewed and approved by the administrator. If you add new scopes to your app later, you’re unable to request those scopes from users until the admin reapproves your app. Existing authorizations and new authorizations using the previously allowlisted set of scopes continue to work. For more information, see [connected apps for administrators](https://docs.mulesoft.com/access-management/connected-apps-org-admin#application-allowlist-admin). ## See Also - [Access Management API](https://dev-portal.mulesoft.com/apis/access-management.html) - [Creating Connected Apps in Anypoint Platform](https://docs.mulesoft.com/access-management/creating-connected-apps-dev) - [Anypoint Platform Connected Apps for Organization Administrators](https://docs.mulesoft.com/access-management/connected-apps-org-admin) --- product: Access Management version: master --- # Anypoint Platform Connected Apps for End Users > For the full documentation index, see: https://docs.mulesoft.com/llms.txt Delegate API access and sign in to third-party applications using your Anypoint Platform credentials. You can also view connected apps created in your root organization or business groups. > [!NOTE] The organization administrator must set up and integrate the connected app before you can > grant access to it. See > [Anypoint Platform Connected Apps for Developers](https://docs.mulesoft.com/access-management/connected-apps-developers). To grant access to a connected app: 1. In the **Authorize App** dialog, click **Grant Access**. You can see which organization is requesting access to data and how the data is used. After you click **Grant Access**, the app is authorized to access the data indicated in the **Authorize App** dialog. ![App authorization with username and a list of permissions granted to the app](/mulesoft/current/en-us/access-management/_images/connected-apps-authorize.png) ## Manage Third-Party Apps You can manage authorized third-party apps in your profile settings: 1. Click your profile icon and select **Profile**. ![A user’s profile that contains authorized connected apps and their scopes](/mulesoft/current/en-us/access-management/_images/connected-apps-in-profile.png) The **Application Name** column lists the name of the app the user is sharing data with. The **Scopes** column lists the token granted to the app and the permissions the connected app has. If an organization administrator blocks an app, you can’t authorize the app to access your information. Because most applications are developed by third parties, MuleSoft is not liable for how an app uses the data it’s requesting access to. You can navigate to the developer information link and contact the application’s admin if you have questions or concerns about the application. ## See Also - [Anypoint Platform Connected Apps for Developers](https://docs.mulesoft.com/access-management/connected-apps-developers) - [Anypoint Platform Connected Apps for Organization Administrators](https://docs.mulesoft.com/access-management/connected-apps-org-admin) --- product: Access Management version: master --- # Anypoint Platform Connected Apps for Organization Administrators > For the full documentation index, see: https://docs.mulesoft.com/llms.txt As an organization administrator at the root organization or business group level, you can view and manage connected apps in Access Management. You can use authorization policies to dictate which apps are authorized to access user data, and you can add apps to an allowlist. ## Connected App Ownership Connected app ownership gets transferred to the root organization owner when the user who created the connected app: - Is deleted - Is removed from the root organization - Loses administrative privileges over the organization To maintain security, manually rotate the client secrets of all connected apps in the organization after the transfer. For more information about how to manually rotate client secrets, see [Modify the Client Secret for a Connected App](#modify-client-secret). You can also reset client secrets programmatically using the [Access Management API](https://dev-portal.mulesoft.com/apis/access-management.html). ## Manage Owned Apps To maintain security, you can view and manage connected apps only if you have the Organization Administrator permission in the root organization or in the business group where the connected app resides. To manage your connected apps: 1. Navigate to **Access Management** and select the **Connected Apps** tab. 2. Add and edit apps in the **Owned Apps** section. 3. Manage app access in the **Authorizations** section. ### Edit the App Owner Organization administrators can edit the owner of the connected app and transfer the ownership to other administrators: 1. In **Access Management** > **Connected Apps** > **Owned Apps**, click the app name. 2. Make the changes and click **Save changes**. ### Modify the Client Secret for a Connected App 1. In the Access Management navigation menu, click **Connected Apps**. 2. Click a connected app from the list to enable edit mode. 3. In the **Secret** field, enter a secret of your choice. 4. Click **Save**. ![Edit mode for a connected app](/mulesoft/current/en-us/access-management/_images/connected-apps-edit-mode.png)
1Name and username of the owner of the connected app
2Name of the connected app
3ID of the connected app
4Client secret of the connected app
### View Authorizations 1. In the **Authorizations** tab, select the app. 2. Click the more actions menu (**…​**) for the application and select **Show details**. ### Revoke Authorization When you revoke an app’s access, the app’s OAuth 2.0 access tokens and refresh tokens are revoked, and the app can no longer access user data. This action can’t be undone. 1. In the **Authorizations** tab, select the app. 2. Click the more actions menu (**…​**) for the selected application and select **Remove**. 3. Click **Remove**. ## Configure Authorization Policies You can configure one of these types of authorization policies for your users: - Unrestricted Organization members can authorize any connected app to act on their behalf. - Restricted Only connected apps that are added to an allowlist by an administrator are authorized by organization members to act on their behalf. By default, the **Unrestricted** policy is enabled. If you change the policy to **Restricted**, the application allowlist is enabled, and all existing application authorizations are added automatically. When using the **Restricted** policy, you can disable auto-approval of all internal apps, in which case you must add each internal app to the [application allowlist](#application-allowlist-admin) like any other connected app. ### Application Allowlist When the allowlist is enabled, organization users can use only applications that are on the allowlist. If a user attempts to authorize an app that’s not on the allowlist, they are prompted to contact their organization administrator. ![The interface the user sees when an app is not on the allowlist](/mulesoft/current/en-us/access-management/_images/connected-apps-allowlist-blocked.png) Organization administrators can add the app to the allowlist by following the link given to them by the end user. ![The interface the administrator sees when they add an app to the allowlist](/mulesoft/current/en-us/access-management/_images/connected-apps-add-to-allowlist.png) Apps may request additional scopes when developers add new features that require access to more data in your organization. Previously allowed apps _must_ be added to the allowlist again with the new set of scopes before your users can grant those additional scopes to the app. ![The interface the administrator sees when they re-add an app to the allowlist](/mulesoft/current/en-us/access-management/_images/connected-apps-add-to-allowlist-again.png) Existing authorizations continue to work if the app is not added to the allowlist again. New authorizations using the already-allowlisted set of scopes are also allowed. Apps that remove scopes do not need to be added to an allowlist again. > [!NOTE] Applications created by users in the same organization are marked as **internal apps** and > don’t need to be allowlisted manually. ## Root Organization and Business Groups By default, connected apps are configured at the root organization level, not at the business group (sub-organization) levels. When you create a connected app to act on its own behalf using client credentials, you can choose which root organization or business groups to enable it in after you choose scopes. A connected app that acts on behalf of a user receives its own access and permissions based on the scopes, organizations, and business groups to which the user has access. ## See Also - [Anypoint Platform Connected Apps for Developers](https://docs.mulesoft.com/access-management/connected-apps-developers) - [Creating Connected Apps in Anypoint Platform](https://docs.mulesoft.com/access-management/creating-connected-apps-dev) --- product: Access Management version: master --- # Anypoint Platform Environments > For the full documentation index, see: https://docs.mulesoft.com/llms.txt Anypoint Platform lets you create and manage separate deployment environments for APIs and applications. Environments are independent from each other, so you can test applications under the same conditions as your production environment. ## Types of Environments Anypoint Platform supports the following types of environments: - **Production environment**: Provides a production environment where you can deploy applications and APIs publicly. - **Sandbox environment**: Provides useful environments for development and testing. By default, Anypoint Platform accounts are created with one sandbox environment with one vCore assigned to it. Sandbox environments enable you to safely test an application without affecting the production environment. For example, you can create a sandbox environment for a QA team where they can test new releases of applications before deploying in production. You can add users to a sandbox environment without permitting them to access the production environment. This helps to secure your production environment and eliminate the risk of a developer accidentally changing an application in production. Once you are sure an application is safe to expose to users, you can easily promote the application from a sandbox environment to a production environment. - **Design environment**: Enables you to test and run applications at design time. This environment is used by the Design Center application. By default, a new Anypoint Platform account contains one design environment with one vCore assigned to it. Only applications deployed from Design Center can target this environment; you can’t deploy an application to a runtime registered in the Design environment using Runtime Manager. ## Adding Users to an Environment You cannot grant users access to an environment directly. To grant a user access to an environment use role permissions. See [Assigning Permissions to Roles](https://docs.mulesoft.com/access-management/roles#assigning-permissions-to-roles) for more information. ## To Create a New Environment To create a new environment or manage an existing environment: 1. Sign in to Anypoint Platform using an account that has the Organization Administrator permission. 2. Select **Access Management** from the ![gear icon](/mulesoft/current/en-us/access-management/_images/gear.svg) menu. 3. In the Access Management navigation menu, click **Business Groups**. 4. Click the name of your root organization. 5. Click the **Environments** tab. 6. Click **Add Environment**. 7. Enter a name for the environment. 8. Select the environment type. > [!NOTE] You cannot change the environment type after you create your environment. 9. Select at least one [client provider](https://docs.mulesoft.com/access-management/managing-api-clients) for your environment. 10. Optionally, if you added more than one client provider, click **Set as default** to designate a default client provider. If you do not select a default client provider, the first client provider that you added is the default. 11. Click **Create**. ![The Environments interface in Access Management](/mulesoft/current/en-us/access-management/_images/environments-85dc3.png) - Depending on your CloudHub subscription, you might have restrictions on the number and type of environments you can create. - If you create a new environment using the name of an existing environment, `-` is appended to the name of the new environment. `` is an incremental number. ## To Modify or Delete an Existing Environment 1. Sign in to Anypoint Platform using an account that has the Organization Administrator permission. 2. Select **Access Management** from the ![gear icon](/mulesoft/current/en-us/access-management/_images/gear.svg) menu. 3. In the Access Management navigation menu, click **Business Groups**. 4. Click the name of your root organization. 5. Click the **Environments** tab. 6. Click the name of the environment. You can perform one of the following actions: - Modify the environment: - Enter a new name for the environment. - Add at least one client provider. - Designate a default client provider if the environment uses more than one client provider. Click **Update** to save your changes. - Click **Delete** to delete the environment. ## To View the Client ID and Client Secret for an Environment Each environment has a client ID and a client secret used for authentication. You must use these values to configure a customer-hosted Mule Runtime or legacy API Gateway to be able to deploy proxies or APIs to CloudHub. To view the client ID and secret for your environment: 1. Sign in to Anypoint Platform using an account that has the Organization Administrator permission. 2. Select **Access Management** from the ![gear icon](/mulesoft/current/en-us/access-management/_images/gear.svg) menu. 3. In the Access Management navigation menu, click **Business Groups**. 4. Click the name of your root organization. 5. Click the **Environments** tab. 6. Click the name of the environment whose client ID/secret you want to view. > [!NOTE] To change the client secret for an environment, see > [How to set or reset environment client\_secret in Anypoint Platform](https://help.salesforce.com/s/articleView?id=001115221&type=1), > or contact your customer support representative. ## Associate a Client Provider with an Existing Environment If your organization administrator provides multiple [client providers](https://docs.mulesoft.com/access-management/managing-api-clients) for your organization, you can add them to existing environments. If you did not associate a client provider with the environment when you created it, the default client provider is the Anypoint Platform client provider. To associate a client provider with an existing environment: 1. Sign in to Anypoint Platform using an account that has the Organization Administrator permission. 2. Select **Access Management** from the ![gear icon](/mulesoft/current/en-us/access-management/_images/gear.svg) menu. 3. In the Access Management navigation menu, click **Business Groups**. 4. Click the name of your root organization. 5. Click the **Environments** tab. 6. Click the name of the environment. 7. In the **Client Provider** field, select at least one client provider. 8. If you added more than one client provider, click **Set as default** to designate a default client provider. 9. Click **Update**. The update applies only to new APIs in this environment. If you want to change the client provider for an existing API, you can do that by [editing the API in API Manager](https://docs.mulesoft.com/api-manager/latest/edit-api-endpoint-task) and selecting the client provider from the **Client provider** dropdown. ## Remove a Client Provider from an Environment You can remove a client provider from an environment at any time. However, prior to removing the default client provider, specify another client provider as default. When you remove all external client providers from an environment, the built-in Anypoint Platform client provider becomes the default client provider for that environment. 1. Sign in to Anypoint Platform using an account that has the Organization Administrator permission. 2. Select **Access Management** from the ![gear icon](/mulesoft/current/en-us/access-management/_images/gear.svg) menu. 3. In the Access Management navigation menu, click **Business Groups**. 4. Click the name of your root organization. 5. Click the **Environments** tab. 6. Click the name of the environment. 7. If the client provider that you want to remove is the default, click **Set as default** next to the name of a different client provider. 8. Click the **Remove** button next to the name of the client provider that you want to remove. 9. Click **Update**. The client provider is removed. Any assets or APIs that were associated with the client provider continue to use it until you associate them with a new client provider. --- product: Access Management version: master --- # Anypoint Platform External Organization Access > For the full documentation index, see: https://docs.mulesoft.com/llms.txt External organization access in Anypoint Platform lets separate organizations collaborate by sharing assets in Anypoint Exchange without making them public. Organization administrators control which organizations their users can collaborate with by maintaining a list of trusted organizations in Access Management. Anypoint Platform organization administrators control which organizations their users can collaborate with by maintaining a list of trusted organizations in Access Management. Adding an entry to this list means that you trust the other organization and its users, and you acknowledge that you’re enabling your users to grant permission to and be granted permissions by the other organization. Using the External Access functionality in Access Management, you can: - [Establish a relationship with a trusted Anypoint Platform organization.](https://docs.mulesoft.com/access-management/trusted-anypoint-platform-org) - [Establish a relationship with a trusted Salesforce organization.](https://docs.mulesoft.com/access-management/trusted-salesforce-org) --- product: Access Management version: master --- # Audit Logging in Anypoint Platform > For the full documentation index, see: https://docs.mulesoft.com/llms.txt The audit logging service provides a queryable history of actions performed within Anypoint Platform. It keeps track of all user interactions with objects in the system and timestamps those actions. Audit logging also provides mechanisms for querying the set of users who performed actions, the set of objects that had actions performed on them, and other endpoints that enable log entry querying. Audit logs have a default retention period of one year. If your organization was created before July 10, 2023 and you didn’t manually change the retention period, the retention period is six years. Users who have the Organization Administrator and Audit Log Config Manager permissions can customize the retention period. For more information, see [Configure Audit Log Retention in Anypoint Platform](https://docs.mulesoft.com/access-management/audit-log-retention). Download your logs periodically to retain your log files for longer than the current retention period. You can access audit logs through the Audit Log Query API or through the audit logging UI. ## Access Audit Logging Access audit logs in the UI and via the Audit Log Query API, scoped to your business group. Users who have the Anypoint Platform **Organization Administrator** permission or the **Audit Log Viewer** permission have access to both the UI and the Audit Log Query API. The audit log service is business-group aware, which means you see only logs that are relevant to your own business group. The audit log UI is embedded in Access Management. 1. Sign in to Anypoint Platform. 2. Select **Access Management** from the ![gear icon](/mulesoft/current/en-us/access-management/_images/gear.svg) menu. 3. In the Access Management navigation menu, click **Audit Logs**. The **Audit Logs** page displays the logs. You can: - Download audit logs. - Set a time period for showing audit logs. - Filter audit logs by product, type, and actions. - Search audit logs by environment, object, and user. ## Export Audit Logs Export audit logs to external observability tools using Telemetry Exporter. If you have the Anypoint Integration Advanced package or a Titanium subscription to Anypoint Platform, you can use the [Telemetry Exporter feature](https://docs.mulesoft.com/monitoring/telemetry-exporter) in Anypoint Monitoring to export audit logs to third-party analytics and observability apps. When exported, audit logs have a unique ID in the `mulesoft.audit.id` attribute. In usual operations, each log is delivered only once, but under certain circumstances, some logs are delivered more than once. Duplicate log entries always share the unique `mulesoft.audit.id` attribute, so this attribute can be used to safely block or remove duplicate logs from the target system. Telemetry Exporter for audit logs currently has these data differences, limitations, and known issues: - The audit logs that the Telemetry Exporter sends to third-party apps often have different field names from the audit logs that appear in Access Management or the Audit Query Log API. For example, audit logs shown in the UI or retrieved by the Audit Log Query API describe a user action (such as `update` or `delete`) as `action`, whereas the OpenTelemetry attribute refers to it as `mulesoft.audit.action`. - If the audit log entry metadata and payload field exceed 30KB when compressed, the payload is truncated before compression. ## Audit Log Contents Activities in the audit log are actions that occur at a particular time, involve one or more objects, have an action type (such as `delete` or `approve`) associated with the objects, and optionally a payload that can store application-specific information such as changed fields and environment information. Each log entry has a set of properties that provides information about the activity: - **Time**: Timestamp when the activity occurred - **Product**: Product where the object resides, for example, `Access Management` - **Type**: Type of object the action is performed on, for example, `Organization` - **Action**: Action associated with the object, for example, `Create` - **Object**: Name of the object, for example, `foo` - **User Name**: User who performed the action, for example, `johndoe` > [!NOTE] Occasionally, there are `Anypoint Staff` log entries. This log entry is made when the > audit action was performed by a user who doesn’t belong to your organization. > > `Anypoint Staff` entries are created when these events occur: > > - An internal or system process that’s a routine part of Anypoint Platform operations is > performed > > - The MuleSoft procurement staff changes entitlements for your organization as a result of > license grants > > - An action is performed by a MuleSoft employee on your behalf for other purposes, such as > troubleshooting - **Connected App**: Name of the connected app that takes an action on behalf of itself or a user. If a connected app didn’t run the action, the payload is `N/A`. - **Environment**: Environment names for events from API Manager, Runtime Manager, CloudHub, Partner Manager, and MQ. - **Parent**: (Optional) Parent of the object (if any) the action is performed on. This mainly applies to APIs. - **Payload**: (Optional) More information about the log properties. For example, if an organization is created, the payload contains information about the organization and the owner, such as IDs. This is a list of actions per product and object type that Anypoint Platform audits:
User ActionObject TypeObjectParentActionPayload

Set T&C

T&C

T&C

N/A

Create

Subaction: None
Properties: New T&Cs

Modify T&C

T&C

T&C

N/A

Edit

Subaction: None
Properties: New T&Cs

Set org custom theme

Portal theme

Org name

N/A

Create

Subaction: None
Properties: Theme data

Edit org custom theme

Bus. Group

Org Name

N/A

Edit

Subaction: None
Properties: Theme data

Add custom policy

Policy

PolicyID

N/A

Create

Subaction: None
Properties: None

Delete custom policy

Policy

PolicyID

N/A

Delete

Subaction: None
Properties: Policy data

### APIs
User ActionObject TypeObjectParentActionPayload

Create API

API

API ID

N/A

Create

Subaction: None
Properties: None

Delete API

API

API ID

N/A

Delete

Subaction: None
Properties: None

Import API

API

API ID

N/A

Create

Subaction: None
Properties: None

Update label of API

API

API ID

N/A

Edit

Subaction: None
Properties: API object

Update consumer endpoint of API

API

API ID

N/A

Edit - update endpoint

Subaction: None
Properties: API object

Update endpoint URI of API

API

API ID

N/A

Edit - edit endpoint URI

Subaction: None
Properties: API object

### API Versions
User ActionObject TypeObjectParentActionPayload

Create API version

API version

Version ID

API ID

Create

Subaction: None
Properties: None

Delete API version

API version

Version ID

API ID

Delete

Subaction: None
Properties: None

Import API

API version

Version ID

API ID

Create

Subaction: Import API version
Properties: None

Edit name of API version

API version

Version ID

API ID

Edit

Subaction: Edit name
Properties: New name

Edit description of API version

API version

Version ID

API ID

Edit

Subaction: Edit description
Properties: New description

Edit API URL of API version

API version

Version ID

API ID

Edit

Subaction: Edit API URL
Properties: New API URL

Add tag

API Version

Version ID

API ID

Edit

Subaction: Add tag
Properties: New tag

Remove tag

API Version

Version ID

API ID

Edit

Subaction: Remove tag
Properties: Deleted tag

Deprecate API

API version

Version ID

API ID

Edit

Subaction: Deprecate API
Properties: None

Set T&Cs

API Version

Version ID

API ID

Edit

Subaction: Set terms & conditions
Properties: T&Cs

Create RAML

API Version

Version ID

API ID

Edit

Subaction: Create RAML
Properties: None

Modify RAML

API Version

Version ID

API ID

Edit

Subaction: Edit RAML
Properties: Updated RAML files

Create endpoint

API version

Version ID

API ID

Edit

Subaction: Create endpoint
Properties: New endpoint

Update existing endpoint

API version

Version ID

API ID

Edit

Subaction: Update endpoint
Properties: Create endpoint

Deploy proxy

API Version

Version ID

API ID

Deploy

Subaction: None
Properties: Deploy location (app name & server name for hybrid)

Update deployed proxy

API version

Version ID

API ID

Edit

Subaction: Configure endpoint
Properties: New endpoint

Redeploy proxy

API Version

Version ID

API ID

Deploy

Subaction: None
Properties: Deploy location (app name & server name for hybrid)

Create SLA tier

Tier

SLA ID

Version ID

Create

Subaction: None
Properties: SLA settings

Modify SLA tier

Tier

SLA ID

Version ID

Edit

Subaction: None
Properties: SLA settings

Deprecate SLA tier

Tier

SLA ID

Version ID

Edit

Subaction: Deprecate SLA tier
Properties: SLA settings

Delete SLA tier

Tier

SLA ID

Version ID

Delete

Subaction: None
Properties: None

Apply policy

API policy

Policy ID

Version ID

Create

Subaction: None
Properties: Policy settings

Edit policy

API policy

Policy ID

Version ID

Edit

Subaction: None
Properties: Policy settings

Remove policy

API policy

Policy ID

Version ID

Delete

Subaction: None
Properties: None

### Application
User ActionObject TypeObjectParentActionPayload

Create application

Application

App ID

N/A

Create

Subaction: None
Properties: Application

Delete application

Application

App ID

N/A

Delete

Subaction: None
Properties: None

Reset client secret

Application

App ID

N/A

Edit - reset client secret

Subaction: Reset client secret
Properties: None

Request access

Contract

Object 1: App ID
Object 2: API version ID

N/A

Create

Subaction: None
Properties: SLA tier

Request tier change

Contract

Object 1: App ID
Object 2: API version ID

N/A

Edit - request tier change

Subaction: Request tier change
Properties: New tier

Request tier change approval

Contract

Object 1: App ID
Object 2: API version ID

N/A

Edit - request tier change approval

Subaction: Request tier change approval
Properties: New tier

Approve application

Contract

Object 1: App ID
Object 2: API version ID

N/A

Edit - contract approval

Subaction: Contract approval
Properties: SLA tier

Revoke application

Contract

Object 1: App ID
Object 2: API version ID

N/A

Edit - contract revoke

Subaction: Contract revoked
Properties: SLA tier

Restore application

Contract

Object 1: App ID
Object 2: API version ID

N/A

Edit - contract restore

Subaction: Contract restored
Properties: SLA tier

The `Create Application` and `Delete Application` actions are logged at the root organization level. ## Access Management Audited actions for Access Management entities, including users, roles, permissions, identity providers, organizations, environments, and connected apps. ### Users Audit logging for login activities follows these rules: - Organization Scope Login and logout actions are logged only at the organization level. - Anypoint Platform Accounts Login failures are logged only for existing user accounts. - SSO via SAML Login failures are recorded in the audit log. - SSO via LDAP or OIDC Login failures are not recorded in the audit log. This applies to both Anypoint Platform and Anypoint Platform Private Cloud Edition (Anypoint Platform PCE).
User ActionObject TypeObjectParentActionPayload

Signup / Organization creation

User

UserID

N/A

Create

Subaction: None
Properties: Organization ID

User creation (w/out creating an org)

User

UserID

N/A

Create

Subaction: None
Properties: UserID

Password reset requested

User

UserID

N/A

Edit

Subaction: Password reset
Properties: None

Password changed

User

UserID

N/A

Edit

Subaction: Password changed
Properties: None

Delete user

User

UserID

N/A

Delete

Subaction: None
Properties: User object

Disable user

User

UserID

N/A

Edit

Subaction: Disable user
Properties: None

Login success

User

UserID

N/A

Login

Subaction: None
Properties: None

Login success reauthenticate

User

UserID

N/A

Login - Reauthenticate

Subaction: Reauthenticate
Properties: None

Login failure

User

UserID

N/A

Login

Subaction: Failure
Properties: Error message

Login failure reauthentication

User

UserID

N/A

Login - Reauthentication Failure

Subaction: Reauthentication Failure
Properties: Error message

Logout

User

UserID

N/A

Logout

Subaction: None
Properties: None

### Roles
User ActionObject TypeObjectParentActionPayload

Create role

Role

Role

N/A

Create

Subaction: None
Properties: None

Edit role - add user

Object 1: Role
Object 2: User

Object 1: Role
Object 2: User

N/A

Edit

Subaction: Add user
Properties: Role, User

Edit role - remove user

Object 1: Role
Object 2: User

Object 1: Role
Object 2: User

N/A

Edit

Subaction: Remove user
Properties: Role, User

Edit role - change external group mapping

Role

Role

N/A

Edit

Subaction: Edit role mapping
Properties: New mapping

Delete role

Role

Role

N/A

Delete

Subaction: None
Properties: Role metadata

### Permissions
User ActionObject TypeObjectParentActionPayload

User permission change

Permission

Object 1: User
Object 2: Resource

Parent 1: N/A
Parent 2: Resource parent if applicable

Permissions change

Subaction: None
Properties: New permission

Role permission change

Permission

Object 1: Role
Object 2: Resource

Parent 1: N/A
Parent 2: Resource parent if applicable

Permissions change

Subaction: None
Properties: New permission

Environment permissions change

Permission

EnvID

N/A

Permissions change

Subaction: None
Properties: New permissions

### Identity Management
User ActionObject TypeObjectParentActionPayload

Create identity provider configuration

Identity management

Provider name

N/A

Create

Subaction: None

Edit identity provider configuration

Identity management

Provider name

N/A

Edit

Subaction: None

Delete identity provider configuration

Identity management

Provider name

N/A

Delete

Subaction: None

Warning

Object 1: Identity management
Object 2: User

Object 1: Provider name
Object 2: UserID

N/A

None

Subaction: None
Properties: Message

Create identity management key

Identity management key

KeyID

N/A

Create

Subaction: None

Set primary identity management key

Identity management key

KeyID

N/A

Edit

Subaction: Set primary key
Properties:

  • old_primary_provider_key_id

  • provider_key_id

Delete identity management key

Identity management key

KeyID

N/A

Delete

Subaction: None

### Organization and Business Groups
User ActionObject TypeObjectParentActionPayload

Edit domain name

Organization

OrgID

N/A

Edit

Subaction: None
Properties: New name

Create business group

Organization

OrgID

Parent organization

Create

Subaction: None
Properties: Org object

Edit business group name

Organization

OrgID

Parent organization

Edit

Subaction: Edit name
Properties: New group name

Edit business group owner

Organization

OrgID

Parent organization

Edit

Subaction: Edit owner
Properties: New owner userID

Edit business group entitlement

Entitlement

EnvID

N/A

Edit

Subaction: Edit entitlement
Properties: Entitlement change

Delete business group

Organization

OrgID

Parent organization

Delete

Subaction: None
Properties: Org object

### Environments
User ActionObject TypeObjectParentActionPayload

Create environment

Environment

EnvID

N/A

Create

Subaction: None
Properties: None

Delete environment

Environment

EnvID

N/A

Delete

Subaction: None
Properties: Environment metadata

Rename environment

Environment

EnvID

N/A

Edit

Subaction: None
Properties: Environment name

Environments that are created automatically when you create an organization or business group don’t have audit log entries. As Anypoint Platform has evolved, the default environments have also changed over time. Currently, Sandbox and Design are created automatically and don’t have audit log entries.
### Connected Apps
User ActionObject TypeObjectParentActionPayload

Create Connected Application

Connected Application

clientID

N/A

Create

Subaction: None
Properties:

  • clientName

  • clientID

  • clientIP

  • orgID

  • grantTypes

Edit Connected Application

Connected Application

clientID

N/A

Edit

Subaction: None
Properties:

  • clientName

  • clientID

  • clientIP

  • orgID

  • grantTypes

Delete Connected Application

Connected Application

clientID

N/A

Delete

Subaction: None
Properties:

  • clientName

  • clientID

  • clientIP

  • orgID

  • grantTypes

Update Scope Assignments

Connected Application

clientID

N/A

Permissions Change

Subaction: Add Assignments
Properties: Scopes

Application Authorization Approved

External Authorization

clientID

N/A

Approved

Subaction: None
Properties: None

Application Authorization Denied

External Authorization

clientID

N/A

Denied

Subaction: None
Properties: None

Token Retrieval Success

Connected Application

clientID

N/A

Login - Token

Subaction: Token
Properties:

  • clientName

  • clientID

  • clientIP

  • orgID

  • grantTypes

Token Retrieval Failed

Connected Application

clientID

N/A

Login - Token

Subaction: Token
Properties:

  • clientID

  • clientIP

  • Error Message

Revoke Access/Refresh Tokens

Connected Application

clientID

N/A

Revoke Tokens

Subaction: None
Properties:

  • clientName

  • clientID

  • clientIP

  • orgID

  • grantTypes

### Teams
User ActionObject TypeObjectParentActionPayload

Create Team

Team

Team Name

N/A

Create

Subaction: None
Properties:

  • org_id

  • team_id

  • team_name

  • team_type

  • created_at

  • updated_at

  • ancestor_team_ids

Update Team

Team

Team Name

N/A

Update

Subaction: None
Properties:

  • org_id

  • team_id

  • team_type

  • ancestor_team_ids

Move Team

Team

Team Name

N/A

Move

Subaction: None
Properties:

  • org_id

  • team_id

  • team_type

  • ancestor_team_ids

  • previous_ancestor_team_ids

Add Members

Team

Team Name

N/A

Edit

Subaction: Add Members
Properties:

  • array of:

    • id (Member/Maintainer ID)

    • membership_type

Remove Members

Team

Team Name

N/A

Edit

Subaction: Remove Members
Properties:

  • Removed Member ID

Add Permissions

Team

Team Name

N/A

Permissions change

Subaction: Add permissions
Properties:

  • name (Permission Name)

  • role_id (Permission ID)

  • context_params)

Remove Permissions

Team

Team Name

N/A

Permissions change

Subaction: Remove permissions
Properties:

  • name (Permission Name)

  • role_id (Permission ID)

  • context_params)

Edit External Group Mappings

Team

Team Name

N/A

Edit

Subaction: Edit external group mapping
Properties:

  • data:

    • provider_id

    • membership_type

    • external_group_name

  • total

Delete Team

Team

Team Name

N/A

Delete

Subaction: None
Properties:

  • org_id

  • team_id

  • ancestor_team_ids

### User IdP Profiles
User ActionObject TypeObjectParentActionPayload

Create User IdP Profile

User IdP Profile

N/A

N/A

Create

Subaction: None
Properties:

  • userId

  • idpUserId

  • providerId

  • loginProfileData

## Anypoint DataGraph Audited actions related to DataGraph operations, such as adding, updating, and removing APIs from unified schemas.
User ActionObject TypeObjectParentActionPayload

Add API

User

data-graph-{api-name}-{env-name}

N/A

Add API

N/A

Update API

User

data-graph-{api-name}-{env-name}

N/A

Update API

N/A

Remove API

User

data-graph-{api-name}-{env-name}

N/A

Remove API

N/A

## Anypoint MQ Audited actions for messaging components, including queues, exchanges, bindings, and clients.
User ActionObject TypeObjectParentActionPayload

Create/modify/delete/purge queue

Queue

queueID

N/A

Create/modify/delete

Subaction: None
Properties: Queue metadata

Create/modify/delete exchange

Exchange

exchangeID

N/A

Create/modify/delete

Subaction: None
Properties: Exchange metadata

Create/delete exchange binding

Binding

bindingID

N/A

Create/delete

Subaction: None
Properties: Exchange metadata

Create/delete/regenerate client

Client

clientID

N/A

Create/delete/regenerate

Subaction: None
Properties: Client metadata

## API Designer APIs Audited actions for Design Center projects and API design activities, including project lifecycle and asset publication.
User ActionObject TypeObjectParentActionPayload

Create project

Project

Project ID

N/A

Create project

Subaction: None
Properties:

  • orgID

  • userID

  • projectName

Delete project

Project

Project ID

N/A

Delete project

Subaction: None
Properties:

  • orgID

  • userID

  • projectName

Delete files

Files

Project ID

N/A

Delete files

Subaction: None
Properties:

  • orgID

  • userID

  • projectName

Rename project

Project

Project ID

N/A

Rename project

Subaction: None
Properties:

  • orgID

  • userID

  • newProjectName

Clean branch

Project

Project ID

N/A

Clean branch

Subaction: None
Properties:

  • orgID

  • userID

  • branchName

Create branch

Project

Project ID

N/A

Create branch

Subaction: None
Properties:

  • orgID

  • userID

  • branchName

Delete branch

Project

Project ID

N/A

Delete branch

Subaction: None
Properties:

  • orgID

  • userID

  • branchName

Save branch

Project

Project ID

N/A

Save branch

Subaction: None
Properties:

  • orgID

  • userID

  • branchName

Delete file

Project

Project ID

N/A

Delete file

Subaction: None
Properties:

  • orgID

  • userID

  • File Path

Move file

Project

Project ID

N/A

Move file

Subaction: None
Properties:

  • orgID

  • userID

  • targetFile

Import project

Project

Project ID

N/A

Import project

Subaction: None
Properties:

  • orgID

  • userID

  • branchName

Publish to Exchange

Project

Project ID

N/A

Publish to Exchange

Subaction: None
Properties:

  • orgID

  • userID

  • projectName

Publish to API Platform

Project

Project ID

N/A

Publish to API Platform

Subaction: None
Properties:

  • orgID

  • userID

  • projectName

Add dependencies

Project

Project ID

N/A

Add dependencies

Subaction: None
Properties:

  • orgID

  • userID

  • dependencies

Remove dependencies

Project

Project ID

N/A

Remove dependencies

Subaction: None
Properties:

  • orgID

  • userID

  • dependencies

Change dependencies

Project

Project ID

N/A

Change dependencies

Subaction: None
Properties:

  • orgID

  • userID

  • addDependencies

  • removeDependencies

Reload dependencies

Project

Project ID

N/A

Reload dependencies

Subaction: None
Properties:

  • orgID

  • userID

  • branchName

Merge Branch

Project

Project ID

N/A

Merge Branch

Subaction: None
Properties:

  • orgID

  • projectID

  • userID

  • branchName

Share project

Project

Project ID

N/A

Share project

Subaction: None
Properties:

  • orgID

  • projectID

  • userID

  • projectID

Sync with Github

Project

Project ID

N/A

Sync with Github

Subaction: None
Properties:

  • orgID

  • projectID

  • userID

  • repositoryName

Unsync with Github

Project

Project ID

N/A

Unsync with Github

Subaction: None
Properties:

  • orgID

  • projectID

  • userID

  • projectID

Modify organization settings

Project

Organization ID

N/A

Modify organization settings

Subaction: None
Properties:

  • orgID

  • projectID

  • userID

  • projectID

Rename branch

Project

Project ID

N/A

Rename branch

Subaction: None
Properties:

  • orgID

  • projectID

  • userID

  • branchName

Modify project settings

Project

Project ID

N/A

Modify project settings

Subaction: None
Properties:

  • orgID

  • projectID

  • userID

  • projectID

### Mocking Service
User ActionObject TypeObjectParentActionPayload

Create link

Link

Link ID

N/A

Create

Subaction: Create Link
Properties: Link metadata

Delete link

Link

Link ID

N/A

Delete

Subaction: Delete Link
Properties: Link metadata

### Portals These actions apply to API Manager v1.x portals:
User ActionObject TypeObjectParentActionPayload

Create portal

Portal

Object 1: Portal ID
Object 2: API Version ID

N/A

Create

Subaction: None
Properties: None

Modify portal association

Portal

Object 1: Portal ID
Object 2: API version ID

N/A

Edit

Subaction: Change portal association
Properties: None

Delete portal

Portal

Portal ID

N/A

Delete

Subaction: None
Properties: None

Add portal page

Portal

Page ID

Portal ID

Edit

Subaction: Add portal page
Properties: Page content

Make portal page visible

Portal

Page ID

Portal ID

Edit

Subaction: Make page visible
Properties: Page content

Delete portal page

Portal

Page ID

Portal ID

Delete

Subaction: Delete portal page
Properties: Page content

Edit portal page

Portal

Page ID

Portal ID

Edit

Subaction: Edit portal page
Properties: Page content

Hide portal page

Portal

Page ID

Portal ID

Edit

Subaction: Hide portal page
Properties: Page content

Set portal theme

Portal

Portal ID

N/A

Edit

Subaction: Set portal theme
Properties: Theme settings

Modify portal theme

Portal

Portal ID

N/A

Edit

Subaction: Modify portal theme
Properties: Theme settings

Modify portal security

Portal

Portal ID

N/A

Edit

Subaction: Set security
Properties: Public / private state

## API Governance Audited actions for governance profiles and enforcement activities across your APIs.
User ActionObject TypeObjectParentActionPayload

Create profile

Profile

Profile name

N/A

Create

Subaction: None
Properties: None

Update profile

Profile

Profile name

N/A

Update

Subaction: None
Properties: None

Delete profile

Profile

Profile name

N/A

Delete

Subaction: None
Properties: None

Activate profile

Profile

Profile name

N/A

Activate

Subaction: None
Properties: None

## Exchange Audited actions for Exchange assets, portals, metadata, and sharing operations. ### Assets
User ActionObject TypeObjectParentActionPayload

Create an asset

Asset

Asset ID

N/A

Create

Subaction: None
Properties: Asset object

Update an asset

Asset

Asset ID

N/A

Update

Subaction: None
Properties: Asset object

Delete an asset

Asset

Asset ID

N/A

Delete

Subaction: None
Properties: None

Share an asset

Asset

Asset ID

N/A

Granted or revoked permissions

Subaction: None
Properties:

  • Asset object

  • Source

  • Target

  • Role

Publish an asset to public portal

Asset Version Group

Asset ID and version group

N/A

Publish to public portal

Subaction: None
Properties: Asset ID, name and type

Remove an asset from public portal

Asset Version Group

Asset ID and version group

N/A

Remove from public portal

Subaction: None
Properties: Asset ID, name and type

Update an asset icon

Asset icon

Asset ID

Asset

Update

Subaction: None
Properties: Asset object

Delete an asset icon

Asset icon

Asset ID

Asset

Delete

Subaction: None
Properties: Asset object

Create a managed tag (category)

Asset managed tag

Asset ID and tag ID

Asset

Create

Subaction: None
Properties: None

Delete a managed tag (category)

Asset managed tag

Asset ID and tag ID

Asset

Delete

Subaction: None
Properties: None

Delete an organization

Organization

Organization ID

N/A

Delete

Subaction: None
Properties: None

Update tags

Asset tags

Asset ID

Asset

Update

Subaction: None
Properties: Tags

Create a tag configuration

Tag configuration

Tag configuration ID

N/A

Create

Subaction: None
Properties: TagConfiguration

Update a tag configuration

Tag configuration

Tag configuration ID

N/A

Update

Subaction: None
Properties: TagConfiguration

Delete a tag configuration

Tag configuration

Tag configuration ID

N/A

Delete

Subaction: None
Properties: None

### Asset Portals
User ActionObject TypeObjectParentActionPayload

Create a page

Asset portal page

Page ID

Asset portal

Create

Subaction: None
Properties:

  • Asset object

  • Page

Update a page

Asset portal page

Page ID

Asset portal

Update

Subaction: None
Properties:

  • Asset object

  • Page

Delete a page

Asset portal page

Page ID

Asset portal

Delete

Subaction: None
Properties: None

Create a portal

Asset portal

Portal ID

Asset

Create

Subaction: None
Properties: Asset portal

Publish a portal

Asset portal

Portal ID

Asset

Publish

Subaction: None
Properties: Asset portal

### API Metadata
User ActionObject TypeObjectParentActionPayload

Create an API instance

API instance

API instance ID

N/A

Create

Subaction: None
Properties:

  • Name

  • isPublic

Delete an API instance

API instance

API instance ID

N/A

Delete

Subaction: None
Properties:

  • Name

  • isPublic

Update an API instance

API instance

API instance ID

N/A

Update

Subaction: None
Properties:

  • Name

  • isPublic

### File Upload
User ActionObject TypeObjectParentActionPayload

Upload file

Exchange file

File ID

N/A

Create

Subaction: None
Properties: File key

Delete file

Exchange file

File ID

N/A

Delete

Subaction: None
Properties: File key

Update file

Exchange file

File ID

N/A

Update

Subaction: None
Properties: File key

### Public Portals
User ActionObject TypeObjectParentActionPayload

Update a domain

Public portal domain

Organization ID and domain

Public portal

Update

Subaction: None
Properties:

  • Portal ID

  • Domain

Delete a domain

Public portal domain

Organization ID and domain

Public portal

Delete

Subaction: None
Properties:

  • Portal ID

  • Domain

Create a page

Public portal page

Page path

Public portal

Create

Subaction: None
Properties:

  • Portal ID

  • Page ID

Delete a page

Public portal page

Page path

Public portal

Delete

Subaction: None
Properties:

  • Portal ID

  • Page ID

Update a page

Public portal page

Page path

Public portal

Update

Subaction: None
Properties:

  • Portal ID

  • Page ID

Create a portal

Public portal

Organization ID

N/A

Create

Subaction: None
Properties:

  • Project ID

  • Created by ID

Publish a portal

Public portal

Organization ID

N/A

Publish

Subaction: None
Properties:

  • Project ID

  • Created by ID

Delete a portal

Public portal

Organization ID

N/A

Delete

Subaction: None
Properties:

  • Project ID

  • Created by ID

Update a portal

Public portal

Organization ID

N/A

Update

Subaction: None

Properties:

  • Project ID

  • Created by ID

### Asset Reviews
User ActionObject TypeObjectParentActionPayload

Create a Comment

Asset portal review comment

Comment ID

Asset portal review

Create

Subaction: None
Properties: Comment

Delete a comment

Asset portal review comment

Comment ID

Asset portal review

Delete

Subaction: None
Properties: Comment

Update a comment

Asset portal review comment

Comment ID

Asset portal review

Update

Subaction: None
Properties: Comment

Create a review

Asset portal review

Review ID

Asset

Create

Subaction: None
Properties: Review object

Delete a review

Asset portal review

Review ID

Asset

Delete

Subaction: None
Properties: Review object

Update a review

Asset portal review

Review ID

Asset

Update

Subaction: None
Properties: Review object

## IDP Audited actions for Intelligent Document Processing (IDP), including document actions, versions, executions, and reviewer updates.
User actionObject typeObjectParentActionPayload

Create Document Action

Document Action

Document Action Id

Create

Subaction: none
Properties:

  • Document Action Id

  • Timestamp

  • User Id

  • Document Action Name

Update Document Action

Document Action

Document Action Id

Update

Subaction: none
Properties:

  • Document Action Id

  • Timestamp

  • User Id

  • Document Action Name

Add/Delete reviewers to/from a Document Action

Document Action

Document Action Id

Update

Subaction: none
Properties:

  • Document Action Id

  • Timestamp

  • User Id

  • Reviewer Ids

Delete Document Action

Document Action

Document Action Id

Delete

Subaction: none
Properties:

  • Document Action Id

  • Timestamp

  • User Id

  • Document Action Name

Document Action Version Created

Document Action Version

Document Action Version Id

Create

Subaction: none
Properties:

  • Document Action Id

  • Document Action Version Id

  • Timestamp

  • User Id

  • Document Action Name

  • Document Action Version Name

Document instance is reviewed

Document Action Execution

Document Action Execution Id

Update

Subaction: none
Properties:

  • Document Action Execution Id

  • Document Action Id

  • Timestamp

  • User Id

## Object Store v2 Audited actions for Object Store v2 resources, including stores and related operations.
User ActionObject TypeObjectParentActionPayload

Create/modify/delete store

Store

storeID

N/A

Create/modify/delete

Subaction: None
Properties: Store metadata

## RPA Audited actions across MuleSoft RPA, including run configurations, processes, bots, credentials, and variables. > [!NOTE] The payload is split when it contains more than 32k (32768) characters. Split audit log > entries have identical correlation IDs. ### Run Configurations
User ActionObject TypeObjectParentActionPayload

Create run configuration

Run configuration

Run configuration ID

N/A

Create

Subaction: None
Properties:

  • Process name

  • Process ID

  • Process phase

  • Run configuration name

  • Run configuration description

  • Run configuration type

  • Run configuration priority

  • Activity parameters

    • Activity Parameter name

      • Mapping with <global variable/credential name>

  • User task user

  • User task group

  • Execution session type

  • Execution user

  • Execution taskbar option

  • Schedule Name

  • Bots

    • Bot name

    • Bot ID

    • Assigned sessions

Edit run configuration

Run configuration

Run configuration ID

N/A

Edit

Subaction: None
Properties:

  • Process name

  • Process ID

  • Process phase

  • Run configuration name

  • Run configuration description

  • Run configuration priority

  • Activity parameters

    • Activity Parameter name

      • Mapping with <global variable/credential name>

  • User task user

  • User task group

  • Execution session type

  • Execution user

  • Execution taskbar option

  • Schedules

    • Schedule name

  • Bots

    • Bot name

    • Bot ID

    • Assigned sessions

Delete run configuration

Run configuration

Run configuration ID

N/A

Delete

Subaction: None
Properties:

  • Process name

  • Process ID

  • Process phase

  • Run configuration name

Deploy run configuration

Run configuration

Run configuration ID

N/A

Deploy

Subaction: None
Properties:

  • Process name

  • Process ID

  • Process phase

  • Run configuration name

  • Schedules

    • Schedule name

  • Bots

    • Bot name

    • Bot ID

    • Assigned sessions

Publish run configuration

Run configuration

Run configuration ID

N/A

Publish

Subaction: None
Properties:

  • Process name

  • Process ID

  • Process phase

  • Run configuration name

Revoke run configuration

Run configuration

Run configuration ID

N/A

Revoke

Subaction: None
Properties:

  • Process name

  • Process ID

  • Process phase

  • Run configuration name

Pause run configuration

Run configuration

Run configuration ID

N/A

Pause

Subaction: None
Properties:

  • Process name

  • Process ID

  • Process phase

  • Run configuration name

Continue run configuration

Run configuration

Run configuration ID

N/A

Continue

Subaction: None
Properties:

  • Process name

  • Process ID

  • Process phase

  • Run configuration name

### Processes
User ActionObject TypeObjectParentActionPayload

Create process

Process

Process ID

N/A

Create

Subaction: none

Properties:

  • Process name

  • Process phase

  • Applications required

    • Application name

  • Process team

    • Member name

    • Assigned phases

  • Advanced permissions option

Edit process

Process

Process ID

N/A

Edit

Subaction: none

Properties:

  • Process name

  • Process phase

  • Applications required

    • Application name

  • Process team

    • Member name

    • Assigned phases

  • Advanced permissions option

Delete process

Process

Process ID

N/A

Delete

Subaction: none

Properties:

  • Process name

  • Process phase

### Bots
User ActionObject TypeObjectParentActionPayload

Register bot

Bot

Bot ID

N/A

Register

Subaction: none

Properties:

  • Bot name

  • API key name

  • Bot version

  • IP address

  • Hostname

  • Time zone

Register bot

Bot

Bot ID

N/A

Register

Subaction: none

Properties:

  • Bot name

  • API key name

  • Bot version

  • IP address

  • Hostname

  • Time zone

  • Bot status

  • Assigned Applications

    • Application name

  • Assigned service times

    • Service time name

  • Phase affiliation

  • Description

  • Assigned Secure Sessions

Delete bot

Bot

Bot ID

N/A

Delete

Subaction: none

Properties:

  • Bot name

### Credential Pool
User ActionObject TypeObjectParentActionPayload

Create credential

Credential

Credential ID

N/A

Create

Subaction: none

Properties:

  • Credential name

  • Credential description

  • User affiliation

  • User group affiliation

  • Phase affiliation

  • Type

Edit credential

Credential

Credential ID

N/A

Edit

Subaction: none

Properties:

  • Credential name

  • Credential description

  • User affiliation

  • User group affiliation

  • Phase affiliation

Delete credential

Credential

Credential ID

N/A

Delete

Subaction: none

Properties:

  • Credential name

### Global Variables
User ActionObject TypeObjectParentActionPayload

Create global variable

Global variable

Global variable ID

N/A

Create

Subaction: none

Properties:

  • Global variable name

  • Global variable description

  • Phase affiliation

  • Type

Edit global variable

Global variable

Global variable ID

N/A

Edit

Subaction: none

Properties:

  • Global variable name

  • Global variable description

  • Phase affiliation

Delete global variable

Global variable

Global variable ID

N/A

Delete

Subaction: none

Properties:

  • Global variable name

### Applications
User ActionObject TypeObjectParentActionPayload

Create Application

Application

Application ID

N/A

Create

Subaction: none

Properties:

  • Application name

  • Application time zone

  • Downtimes

    • Downtime name

Edit Application

Application

Application ID

N/A

Edit

Subaction: none

Properties:

  • Application name

  • Application time zone

  • Downtimes

    • Downtime name

Delete Application

Application

Application ID

N/A

Delete

Subaction: none

Properties:

  • Application name

### Service Times
User ActionObject TypeObjectParentActionPayload

Create service time

Service time

Service time ID

N/A

Create

Subaction: none

Properties:

  • Service time name

  • Timezone

  • Service time start

  • Service time end

Edit service time

Service time

Service time ID

N/A

Edit

Subaction: none

Properties:

  • Service time name

  • Timezone

  • Service time start

  • Service time end

Delete service time

Service time

Service time ID

N/A

Delete

Subaction: none

Properties:

  • Service time name

## Runtime Manager Audited actions for applications, deployments, infrastructure resources, and runtime configuration changes.
User ActionObject TypeObjectParentActionPayload

Create application

Application

AppID

N/A

Create

Subaction: None
Properties: Application metadata

Start application

Application

AppID

N/A

Start

Subaction: None
Properties: Application metadata

Restart application

Application

AppID

N/A

Restart

Subaction: None
Properties: Application metadata

Stop application

Application

AppID

N/A

Stop

Subaction: None
Properties: Application metadata

Delete application

Application

AppID

N/A

Delete

Subaction: None
Properties: Application metadata

Change application zip file

Application

AppID

N/A

Modify

Subaction: None
Properties: Application metadata

Promote application from sandbox

Application

AppID

N/A

Modify

Subaction: None
Properties: Application metadata

Change application runtime

Application

AppID

N/A

Modify

Subaction: None
Properties: Application metadata

Change application worker size

Application

AppID

N/A

Modify

Subaction: None
Properties: Application metadata

Change application worker number

Application

AppID

N/A

Modify

Subaction: None
Properties: Application metadata

Enable/disable persistent queues

Application

AppID

N/A

Modify

Subaction: None
Properties: Application metadata

Enable/disable persistent queue encryption

Application

AppID

N/A

Modify

Subaction: None
Properties: Application metadata

Modify application properties

Application

AppID

N/A

Modify

Subaction: None
Properties: Application metadata

Enable/disable insight

Application

AppID

N/A

Modify

Subaction: None
Properties: Application metadata

Modify log levels

Application

AppID

N/A

Modify

Subaction: None
Properties: Application metadata

Create/modify/delete alerts

Application

AppID

N/A

Modify

Subaction: None
Properties: Application metadata

Enable/disable alerts

Application

AppID

N/A

Modify

Subaction: None
Properties: Application metadata

Create/modify/delete application data

Application

AppID

N/A

Modify

Subaction: None
Properties: Application metadata

Create/modify schedules

Application

AppID

N/A

Modify

Subaction: None
Properties: Application metadata

Create/modify/delete tenants

Application

AppID

N/A

Subaction: None
Properties: Application metadata

Enable/disable schedules

Application

AppID

N/A

Modify

Subaction: None
Properties: Application metadata

Clear queues

Application

AppID

N/A

Clear

Subaction: None
Properties: Application metadata

Enable/Disable static IP

Application

AppID

N/A

Modify

Subaction: None
Properties: Application metadata

Allocate/release static IP

Application

AppID

N/A

Modify

Subaction: None
Properties: Application metadata

Trigger heap dump

Application

AppID

N/A

Trigger Action

Subaction: MULE_DIAGNOSTICS_REPORT
Properties: Application metadata
Note: Actions performed by MuleSoft staff are logged with the User Name Anypoint Staff.

LoadBalancer Create/modify/delete

LoadBalancer

LoadBalancerID

N/A

Create/modify/delete

Subaction: None
Properties: LoadBalancer metadata

Create/modify/delete alerts V2

Alert

AlertID

N/A

Create/modify/delete

Subaction: None
Properties: Alert

Create/modify/delete VPC

VPC

vpcID

N/A

Create/modify/delete

Subaction: None
Properties: VPC metadata

Create/modify/delete VPN

VPN

vpnId

N/A

Create/modify/delete

Subaction: None
Properties: VPN metadata

### Servers
User ActionObject TypeObjectParentActionPayload

Add server

Server

ServerID

N/A

Create

Subaction: None
Properties: Server metadata

Delete server

Server

ServerID

N/A

Delete

Subaction: None
Properties: Server metadata

Rename server

Server

ServerID

N/A

Modify

Subaction: Rename
Properties: Server metadata

Create server group

Server group

ServerGroupID

N/A

Create

Subaction: None
Properties: Server group metadata

Delete server group

Server group

ServerGroupID

N/A

Delete

Subaction: None
Properties: Server group metadata

Rename server group

Server group

ServerGroupID

N/A

Modify

Subaction: Rename
Properties: Server group metadata

Add server to server group

Server group

ServerGroupID

N/A

Modify

Subaction: Add server
Properties: Server group metadata

Remove server from server group

Server group

ServerGroupID

N/A

Modify

Subaction: Remove server
Properties: Server group metadata

Create cluster

Cluster

ClusterID

N/A

Create

Subaction: None
Properties: Cluster metadata

Delete Cluster

Cluster

ClusterID

N/A

Delete

Subaction: None
Properties: Cluster metadata

Rename cluster

Cluster

ClusterID

N/A

Modify

Subaction: Rename
Properties: Cluster metadata

Add server to cluster

Cluster

ClusterID

N/A

Modify

Subaction: Add server
Properties: Cluster metadata

Remove server from cluster

Cluster

ClusterID

N/A

Modify

Subaction: Remove server
Properties: Cluster metadata

Deploy application

Application

ApplicationID

N/A

Deploy

Subaction: None
Properties: Application metadata

Delete application

Application

ApplicationID

N/A

Delete

Subaction: None
Properties: Application metadata

Start application

Application

ApplicationID

N/A

Start

Subaction: None
Properties: Application metadata

Stop application

Application

ApplicationID

N/A

Stop

Subaction: None
Properties: Application metadata

Redeploy application with existing file

Application

ApplicationID

N/A

Redeploy

Subaction: None
Properties: Application metadata

Redeploy application with new file

Application

ApplicationID

N/A

Redeploy

Subaction: Update binary
Properties: Application metadata

### Private Spaces in CloudHub 2.0
User ActionObject TypeObjectParentActionPayload

Create/Modify/Delete private space

Private Space

PrivateSpaceID

N/A

Create/Modify/Delete

Subaction: None
Properties: Private space metadata

Create/Modify/Delete connection

Private Space

PrivateSpaceID

N/A

Create/Modify/Delete

Subaction: None
Properties: Connection metadata

Create/Modify/Delete VPN

Private Space

PrivateSpaceID

N/A

Create/Modify/Delete

Subaction: None
Properties: None

Create/Modify/Delete transit gateway

Private Space

PrivateSpaceID

N/A

Create/Modify/Delete

Subaction: None
Properties: Transit gateway metadata

Create/Modify/Delete TLSContext

Private Space

PrivateSpaceID

N/A

Create/Modify/Delete

Subaction: None
Properties: None

Create/Modify/Delete routes

Private Space

PrivateSpaceID

N/A

Create/Modify/Delete

Subaction: None
Properties:

  • Target

  • Route object

## Secrets Manager Audited actions for secrets and secret groups, including creation, updates, and deletions.
User ActionObject TypeObjectParentActionPayload

Create a secret group

secretGroup

secretGroup name

N/A

Create

Subaction: None
Properties:

  • secretGroup path

  • secrets manager transaction ID

Delete a secret group

secretGroup

secretGroup name

N/A

Delete

Subaction: None
Properties:

  • secretGroup path

  • secrets manager transaction ID

Create a secret

a secret type such as sharedSecret

secret name

N/A

Create

Subaction: None
Properties:

  • secret path

  • secrets manager transaction ID

Update a secret

a secret type such as sharedSecret

secret name

N/A

Update

Subaction: None
Properties:

  • secret path

  • secrets manager transaction ID

Patch a secret

a secret type such as sharedSecret

secret name

N/A

Update

Subaction: None
Properties:

  • secret path

  • secrets manager transaction ID

## Audit Log REST API Access The Audit Log Query API includes pagination options and examples. You can access the [Audit Log REST API](https://dev-portal.mulesoft.com/apis/audit-log-query.html) from the Audit Log Query API. > [!NOTE] Recent events may not appear immediately in Audit Logging Query API results. To retrieve > all events, wait before querying recent time windows or use overlapping time ranges in your > queries. ### Use a Query Loop to Make Requests in Audit Logs The [Audit Log Query API](https://dev-portal.mulesoft.com/apis/audit-log-query.html) uses pagination with cursors, so you can initiate query loops using cursors. Setting the `cursorPagination` query parameter to `true` enables you to use cursor paging. When you use cursor pagination, each response returns a cursor. The cursor corresponds to the last data entry in the response dataset. The subsequent request in the query loop uses the cursor value that was returned in the previous response. When the dataset is empty in the response, you have reached the end of the query loop, and there is no more data to query for that time window. At that point, stop the query loop. When the dataset is empty in the response, no cursor is returned. When you use cursor pagination, `total` isn’t returned by default, because the query loop isn’t dependent on the offset or the number of total rows. To see the total when you use cursor paging, set the `doIncludeTotal` query parameter to true. When the `cursorPagination` query parameter is true and you use `offset` and `cursor` in the query body, `cursor` is prioritized, and `offset` is ignored. There is no mapping between `offset` and `cursor` values; so when you run a query loop over a time window, you can’t switch to the new parameter somewhere in the middle by using the `cursorPagination` and continue the loop. This is because when using `cursorPagination`, `offset` is ignored and the loop restarts from the beginning. The cursor-based pagination API isn’t applicable to the CSV query. The query continues to use offset-based pagination. This example shows a series of calls in a query loop for cursor based query: 1. The first call doesn’t have a cursor in the body and doesn’t request the `total`. The response returns this data: ```console POST https://base/audit/v2/organizations//query?cursorPagination=true ``` Body: ```console { "startDate":"2022-09-01T22:14:47.099Z", "endDate":"2022-11-30T23:14:47.099Z", } ``` Response: ```console { "data": [log entries], "cursor": '123_abcd' } ``` You can use the cursor from the first call’s response in the next call to get the next set of rows. 2. The second call has a specific cursor in the request: ```console POST https://base/audit/v2/organizations//query?cursorPagination=true ``` Body: ```console { "startDate":"2022-09-01T22:14:47.099Z", "endDate":"2022-11-30T23:14:47.099Z", "cursor": '123_abcd' } ``` Response: ```console { "data": [logs], "cursor": '123_xyz' } ``` 3. The third call is the final call in a loop. Because there are no more logs to return, the response doesn’t have a cursor and contains no data. ```console POST https://base/audit/v2/organizations//query?cursorPagination=true ``` Body: ```console { "startDate":"2022-09-01T22:14:47.099Z", "endDate":"2022-11-30T23:14:47.099Z", "cursor": '123_xyz' } ``` Response: ```console { "data": [] } ``` 4. This example shows how to use a cursor and request the total: ```console POST https://base/audit/v2/organizations//query?cursorPagination=true&doIncludeTotal=true ``` Body: ```console { "startDate":"2022-09-01T22:14:47.099Z", "endDate":"2022-11-30T23:14:47.099Z", "cursor": '123_abcds' } ``` Response: ```console { "data": [logs], "cursor": '123_asdfg' "total": 50000 } ``` ### Access the API Using curl Commands These are example `curl` commands for accessing the API (Windows users must download `curl` before using these commands). Get authorization information: ```console curl 'https://anypoint.mulesoft.com/audit/v2/organizations//platforms?include_internal=false' -H 'Authorization: bearer ' ``` Get actions by date range: ```console curl 'https://anypoint.mulesoft.com/audit/v2/organizations//query?include_internal=false' -H 'Authorization: bearer ' -H 'Content-Type: application/json;charset=UTF-8' -H 'Accept: application/json, text/plain, */*' --data-binary '{"startDate":"2017-03-08T20:16:41.250Z","endDate":"2017-03-08T21:16:41.250Z","platforms":[],"objectTypes":[],"actions":[],"objectIds":[],"userIds":[],"ascending":false,"organizationId":"","offset":0,"limit":25}' --compressed ; ``` ### Rate Limit Policy for Audit Log Query Endpoint The Audit Log Query endpoint applies rate limits per IP in the three control planes: US, EU, and gov. This table outlines the rate limits for each control plane:
Control PlaneAllowed requests per minute per IP

US

700

EU

40

Gov

40

If a client exceeds the rate limit for a given control plane, the Audit Log Query endpoint returns a `503 Service Unavailable` status code until the minute expires. During this time, the service is unavailable to the client. It’s best for Audit Log Query Endpoint users to monitor their request rates and adjust their usage accordingly to avoid exceeding the rate limit. Exceeding the rate limit can make the endpoint temporarily unavailable. ## See Also - [Configure Audit Log Retention in Anypoint Platform](https://docs.mulesoft.com/access-management/audit-log-retention) - [Audit Log Query API](https://dev-portal.mulesoft.com/apis/audit-log-query.html) - [Anypoint MQ Audit Logs](https://docs.mulesoft.com/mq/mq-audit-logs) --- product: Access Management version: master --- # Client Management in Anypoint Platform > For the full documentation index, see: https://docs.mulesoft.com/llms.txt Configure up to 25 external client providers in Anypoint Platform to authorize API client applications. Apply OAuth 2.0 policies to protect your APIs, using your chosen OAuth 2.0 provider. This enables you to centralize and scale client authorization across environments. ## Supported OAuth 2.0 Providers To configure client management on Anypoint Platform for supported providers, you must have an identity provider (IdP) account with the provider to use. You can configure these OAuth 2.0 providers: - [OpenAM version: 14](https://docs.mulesoft.com/access-management/conf-client-mgmt-openam-task) - [PingFederate versions: 6 through 8](https://docs.mulesoft.com/access-management/conf-client-mgmt-pf-task) - [Dynamic Client Registration-compliant client providers](https://docs.mulesoft.com/access-management/configure-client-management-openid-task) - [Microsoft Entra ID Client Management](https://docs.mulesoft.com/access-management/configure-client-management-entra-id) Dynamic Client Registration-compliant identity providers must conform to the [OpenID Connect Client Registration 1.0 incorporating errata set 1](https://openid.net/specs/openid-connect-registration-1_0.html). ## Multiple Client Providers You can configure more than one client provider and [associate the client providers with different environments](https://docs.mulesoft.com/access-management/environments#add-an-idp-to-an-existing-environment). If you configure multiple client providers after you create environments, you can associate the new client providers with the environment. Review the existing client configuration before reassigning client providers to avoid any downtime with existing assets or APIs. ## Delete a Client Provider When you delete a client provider from your root organization, the client provider is no longer available in environments that used it. Also, assets or APIs that used the client provider can no longer authorize users who want to access them. > [!WARNING] Before you delete a client provider, make sure that you don’t have APIs, assets, or > environments that depend on the client provider or you will lose functionality. For example, any > APIs that depend on the client provider can no longer authenticate user access. 1. Sign in to Anypoint Platform using an account that has the Organization Administrator permission. 2. Select **Access Management** from the ![gear icon](/mulesoft/current/en-us/access-management/_images/gear.svg) menu. 3. In the **Business Groups** menu, select your root organization. 4. In the Access Management navigation menu, click **Client Providers**. 5. Click the name of the client provider you want to delete. 6. In the client provider’s page, click **Delete**. 7. Enter the name of the client identity provider name. 8. Click **Delete**. ## See Also - [OpenID Connect Client Registration 1.0 incorporating errata set 1](https://openid.net/specs/openid-connect-registration-1_0.html) - [Configuring OpenAM Client Providers in Anypoint Platform](https://docs.mulesoft.com/access-management/conf-client-mgmt-openam-task) - [Configuring PingFederate Client Management in Anypoint Platform](https://docs.mulesoft.com/access-management/conf-client-mgmt-pf-task) - [Configuring OpenID Connect Client Management in Anypoint Platform](https://docs.mulesoft.com/access-management/configure-client-management-openid-task) - [Migrate Client Applications for APIs with External Client Providers in API Manager](https://docs.mulesoft.com/api-manager/latest/migrate-client-apps#migrate_with_external) --- product: Access Management version: master --- # Configure Audit Log Retention in Anypoint Platform > For the full documentation index, see: https://docs.mulesoft.com/llms.txt Control how long audit logs are kept to meet compliance and storage requirements. New organizations default to one year. Organizations created before July 10, 2023, default to six years. Users with **Audit Log Config Manager** and **Organization Administrator** permissions can configure the retention period in Access Management. Download your logs periodically to maintain your log files for longer than six years. To find your organization’s audit log retention period, view the retention setting in your root organization’s settings, or use the [Audit Logging API](https://dev-portal.mulesoft.com/apis/audit-log-query.html). When you configure a retention period: - You can specify a retention period between 30 and 2190 days. - The date the new retention period takes effect must be a minimum of seven days from the current date. - Configuring a new retention period affects your organization’s compliance policy. ## Before You Begin Make sure your account has these permissions: - **Audit Log Config Manager** - **Organization Administrator** (required only if you’re using the user interface to set retention. You don’t need this permission if you’re using the API.) Your organization must also have **Try new features** or the Teams feature enabled in Access Management. ## Configure Audit Log Retention Period Set the number of retention days for the audit log and schedule the date it takes effect. 1. Sign in to Anypoint Platform using an account that has the Organization Administrator and Audit Log Config Manager permissions. 2. Select **Access Management** from the ![gear icon](/mulesoft/current/en-us/access-management/_images/gear.svg) menu. 3. In the **Business Groups** menu, select your root organization. 4. Click the **Settings** tab. 5. Next to **Audit Log Retention Period**, click the pencil icon. 6. In the **Days** field, enter a value between 30 and 2190. 7. In the **Date Effective** field, select the date to start the new retention period on. 8. Click **Save Changes**. A warning appears, confirming your new retention period and effective date. 9. Click **Confirm**. The new audit log retention period takes effect on the date you specified at 00:00:00 UTC. ## See Also - [Audit Logging in Anypoint Platform](https://docs.mulesoft.com/access-management/audit-logging) - [Audit Logging API](https://dev-portal.mulesoft.com/apis/audit-log-query.html) --- product: Access Management version: master --- # Configuring Identity Management in Anypoint Platform > For the full documentation index, see: https://docs.mulesoft.com/llms.txt As an Anypoint Platform organization administrator, you can configure identity management to enable single sign-on (SSO) for your organization’s users. Anypoint Platform supports OpenID Connect for end-user identity verification and SAML 2.0 for web-based authorization, and allows up to 25 external identity providers (IdPs). Configure identity management using one of these single sign-on standards: - OpenID Connect: End user identity verification by an authorization server including SSO - SAML 2.0: Web-based authorization including cross-domain SSO This diagram shows the SAML identity management process: ![A diagram showing the SAML identity management flow](/mulesoft/current/en-us/access-management/_images/external-identity-decbd.png) Before configuring OpenID Connect or SAML 2.0, select an OpenID Connect-compliant provider, such as PingFederate, OpenAM, or Okta. If you are not using OpenID Connect, select any SAML 2.0-compliant provider. Anypoint Platform fully supports these SAML providers: - Salesforce - PingFederate (versions: 6, 7, 8) - OpenAM (version: 14) - Okta These SAML providers are known to work, but aren’t actively tested: - Active Directory Federation Services (AD FS) - Shibboleth - onelogin - CA Single Sign-On - SecureAuth Anypoint Platform fully supports these OpenID Connect providers: - Salesforce - PingFederate (versions: 6, 7, 8) - OpenAM (version: 14) - Okta After you select an identity provider: - Set up your Anypoint Platform organization as your audience in your identity provider configuration. > [!NOTE] The IdP you select is effective for the entire organization and all business groups. - Configure identity management in the Anypoint Platform root organization. - Configure attribute names on the IdP and Anypoint Platform to match. For more information, see the documentation for your identity provider. ## Manage Users with an External Identity Provider After configuring external identity management, you must add new SSO users using your external identity management solution and internal provisioning process. If you use the Invite User feature to add users to your organization after you have configured an external identity provider, the credentials for these users are stored in your organization using the Anypoint identity provider rather than with the external identity provider. Users that sign in with SSO are new users to the system. If the new user has the same username as a user that already exists in your Anypoint Platform organization, the new user co-exists with the original user with the same username. Users with the same username are managed independently from one another. ## See Also - [Configure OpenID Connect](https://docs.mulesoft.com/access-management/conf-openid-connect-task) - [Configure SAML](https://docs.mulesoft.com/access-management/conf-saml-sso) - [Configure LDAP in Anypoint Platform Private Cloud](https://docs.mulesoft.com/access-management/conf-ldap-private-cloud-task) --- product: Access Management version: master --- # Configuring LDAP in Anypoint Platform Private Cloud Edition > For the full documentation index, see: https://docs.mulesoft.com/llms.txt Configure user management for Anypoint Platform Private Cloud Edition (Anypoint PCE) using LDAP version 3. LDAP configuration is available only for Anypoint PCE deployments. 1. From Anypoint Platform, click **Access Management > External Identity**. A form for configuring LDAP appears. 2. In the LDAP configuration form, set the connection settings for your LDAP service. - Host The host name of your LDAP server. If you’re using TLS, use `ldaps://` as the prefix. Otherwise, use `ldap://`. - Port The port used to communicate to your LDAP server. The default ldap port is `389`. The default ldaps port is `636`. - Self-Signed Cert Select this checkbox if you’re using a self-signed certificate on your LDAP server. Use a self-signed certificate for testing your connection to the LDAP server. - Bind DN The distinguished name for the user making the LDAP queries. For example, `uid=admin,ou=people,dc=mulesoft,dc=com`. - Password The password for the LDAP server. For example,`examplepassphrase`. - Connection Timeout The timeout frame (in seconds) for a connection. For example, `10`. - Operation Timeout The timeout frame (in milliseconds) for an operation. For example, `30000`. 3. Set up search bases and filters - User The base level for your user search base object. For example, `uid=admin,dc=mulesoft,dc=com`. - Group The base level for your groups search base object. For example, `ou=groups,dc=mulesoft,dc=com`. 4. Set the distinguished names for your user and group - User The distinguished name for your user search base object. For example,`uid={{username}},ou=people.dc=mulesoft,dc=com`. - Group The distinguished name for your groups search base object. For example, `ou=groups,dc=mulesoft,dc=com`. - Search filters - User by Username The search filter to find users by user name. For example, `(&(objectClass=inetOrgPerson)(uid={{username}}))`. - User by Email The search filter to find users by email. For example, `(&(objectClass=inetOrgPerson)(mail={{email}}))`. - Group by GroupName The search filter to find groups by groupName. For example, `(&(objectClass=groupOfNames)(cn={{groupName}}))`. - User’s Groups by Username The search filter to find user groups by userName. For example, `(&(objectClass=GroupOfNames)(member=uid={{username}},ou=people,dc=mulesoft,dc=com))`. 5. Map the User fields - Username Field that represents the user name. For example, `uid`. - Email Field that represents the email. For example, `mail`. - First Name Field that represents the first name. For example, `givenName`. - Last Name Field that represents the last name. For example, `sn`. - ID ID for your user. For example, `uid`. 6. Map the group fields - Group Name Field that represents your Group name. For example,`cn`. - ID Field that represents your groups Id. For example, `bcd6b4c4-aec5-4493-be1b-8e2e8eecf662`. 7. Save the configuration. --- product: Access Management version: master --- # Configuring Microsoft Entra ID Client Management in Anypoint Platform > For the full documentation index, see: https://docs.mulesoft.com/llms.txt Authenticate and authorize API consumers by using Microsoft Entra ID (formerly Azure AD) as a client provider in Anypoint Platform. Use dynamic client registration to configure Microsoft Entra ID client management and convert OAuth 2.0 client application registration requests to requests supported by Microsoft Entra ID. > [!NOTE] You can’t configure Microsoft Entra ID (formerly Azure AD) as a client provider in > MuleSoft Government Cloud. ## Configure the Client Provider Set up the OpenID Connect Dynamic Client Registration provider for Microsoft Entra ID in Access Management. > [!NOTE] Anypoint Platform doesn’t support Microsoft Azure client providers deployed in Microsoft > national clouds, such as Azure Government or Azure China 21Vianet. 1. Sign in to Anypoint Platform using an account that has the Organization Administrator permission. 2. Select **Access Management** from the ![gear icon](/mulesoft/current/en-us/access-management/_images/gear.svg) menu. 3. In the Access Management navigation menu, click **Client Providers**. 4. Click **Add Client Provider**, and then select **OpenID Connect DCR for Microsoft Entra ID (Azure AD)**. The **Add OIDC Microsoft Entra ID (Azure AD) client provider** page appears. 5. Enter a name and description for your client provider. 6. Enter the values from your identity provider’s configuration: 1. **Issuer**: URL that the OpenID provider asserts is its trusted issuer. 2. **Tenant ID for Microsoft Entra ID**: The tenant ID from Microsoft Entra ID. For more information on obtaining your tenant ID, see [How to find your Microsoft Entra tenant ID](https://learn.microsoft.com/en-us/entra/fundamentals/how-to-find-tenant). 3. **Client ID**: The client ID for an existing client in your identity provider (IdP) that is capable of creating applications in Microsoft Entra ID. 4. **Client Secret**: The client secret that corresponds to the client ID. 5. **Client Secret Expiration Duration**: Duration the application secret is valid for. 180 days is the recommended value and is used by default if you don’t make a selection. The configured expiration duration persists through secret resets and client provider updates. 7. Expand the **Advanced Settings** section. These selections are optional: 1. **Disable server certificate validation**: Disables server certificate validation if your Microsoft Entra ID client management instance presents a self-signed certificate, or one signed by an internal certificate authority. 2. **Enable client deletion in Anypoint Platform**: Enables the deletion of clients created with this integration. 3. **Enable client deletion and updates in IdP**: To use this option, you must also select the **Enable client deletion in Anypoint Platform** option. This option enables you to update and delete external clients in the configured IdP through an outbound call made by Microsoft Entra ID to `[https://graph.microsoft.com/v1.0/applications/{clientId}](https://graph.microsoft.com/v1.0/applications/{clientId})`. For an example of the `PATCH` payload, see the [Update application](https://learn.microsoft.com/en-us/graph/api/application-update?view=graph-rest-1.0&tabs=http) documentation. For an example of the `DELETE` payload, see the [Delete application](https://learn.microsoft.com/en-us/graph/api/application-delete?view=graph-rest-1.0&tabs=http) documentation. 8. Click **Create**. > [!NOTE] To make sure your client management integration remains stable and supported, avoid making > manual edits to the application directly within the Azure portal. > > Modifying the application in Azure can interfere with operational flows managed by Anypoint > Platform, such as client updates and secret resets. If you encounter issues, verify that no manual > changes were made to the application in the Azure portal. ## Service Principals When you register a client application, Anypoint Platform also creates a [service principal](https://learn.microsoft.com/en-us/entra/identity-platform/app-objects-and-service-principals) (enterprise application) for that application in Microsoft Entra ID. The service principal is the identity Microsoft Entra ID uses to represent the application in your tenant. Service principal creation is best-effort. If service principal creation fails, Anypoint Platform still creates and returns the client application, so client registration isn’t blocked. The registration response includes a `service_principal_status` field that reports the outcome, which is one of `created`, `failed`, `skipped`, or `disabled`. ## Supported OAuth 2.0 Features Anypoint Platform provides support for Microsoft Identity Platform access tokens, Microsoft Entra ID v2.0 endpoints, grant types, and client secrets. ### Access Tokens For your APIs, Microsoft Entra ID client management in Anypoint Platform supports both [v1 and v2 JSON Web Tokens](https://learn.microsoft.com/en-us/entra/identity-platform/access-tokens) (JWTs) on Microsoft identity platform. ### OAuth 2.0 Endpoints Anypoint Platform supports only tokens obtained using Microsoft Entra ID v2.0 endpoints, also known as Microsoft identity platform endpoints. For example, Anypoint Platform supports the token endpoint: `[https://login.microsoftonline.com/{tenantId}/oauth2/v2.0/token](https://login.microsoftonline.com/{tenantId}/oauth2/v2.0/token)`. Use these properties when you’re using the Authorization Code grant type to obtain a token: - `authorize url`: `[https://login.microsoftonline.com/{tenantId}/oauth2/v2.0/authorize](https://login.microsoftonline.com/{tenantId}/oauth2/v2.0/authorize)` - `token url`: `[https://login.microsoftonline.com/{tenantId}/oauth2/v2.0/token](https://login.microsoftonline.com/{tenantId}/oauth2/v2.0/token)` - `client id`: {your client id} - `client secret`: {your client secret} - `scope`: `[https://graph.microsoft.com/.default](https://graph.microsoft.com/.default)` Anypoint Platform doesn’t support custom scopes. Use the default scope for Microsoft Graph. ### Grant Types For a list of supported OAuth 2.0 authorization code grant types, see the [Microsoft identity platform documentation](https://learn.microsoft.com/en-us/entra/identity-platform/v2-oauth2-auth-code-flow). When [creating a new application with Microsoft](https://learn.microsoft.com/en-us/graph/api/application-post-applications?view=graph-rest-1.0&tabs=http), you can’t specify the supported OAuth 2.0 authorization code grant types. Because of this limitation on the Microsoft Entra ID side, Anypoint Platform doesn’t support selecting grant types. ### Client Secrets Client secrets (application passwords) use a string value in the Microsoft Entra ID application for authentication instead of a certificate for identity. Client secrets are set to expire six months from the date of creation, following Microsoft’s security recommendations. You can customize the expiration date when [configuring the client provider](#config-client-provider). You can create new client secrets in Anypoint Platform, but you must delete old or expired client secrets directly in your Microsoft account portal. Remove expired secrets promptly. ### Token Introspection Microsoft Entra ID doesn’t provide an introspection endpoint out of the box, but Anypoint Platform has a [policy that implements token introspection for you](https://docs.mulesoft.com/mule-gateway/policies-included-openid-token-enforcement#token-validation-endpoint-authentication) when you configure Microsoft Entra ID as a client provider following the previous flow. When you create your client provider following the OpenID Connect DCR for Microsoft Entra ID flow, Anypoint Platform populates an introspect URL. You can view the URL using `GET /accounts/api/organizations/{orgId}/clientProviders/{clientProviderId}`. During token introspection, Anypoint Platform calls `[https://graph.microsoft.com/v1.0](https://graph.microsoft.com/v1.0)` with your provided token. As long as the response to such a call isn’t a failure, the token is determined to be valid. > [!NOTE] Use the token enforcement policy implementation version 1.7 and later so that during token > introspection, Anypoint Platform calls > `[https://graph.microsoft.com/v1.0](https://graph.microsoft.com/v1.0)` directly, bypassing the > internal Anypoint Platform component. To use this policy, follow the documentation on [OAuth 2.0 Endpoints](#oauth2) to generate supported tokens. #### Token Validation Fails When you try to enforce the OpenID Connect (OIDC) policy by invoking an Anypoint API using a valid token obtained from Microsoft Entra ID and get a `Token has been revoked` error, refer to [OAuth 2.0 Endpoints](#oauth2) to confirm that you obtained the token using a supported method. If the token validation still fails, contact Support. ## See Also - [How to find your Microsoft Entra ID tenant ID](https://learn.microsoft.com/en-us/entra/fundamentals/how-to-find-tenant) - [Microsoft identity platform access tokens](https://learn.microsoft.com/en-us/entra/identity-platform/access-tokens) - [Microsoft National Clouds](https://learn.microsoft.com/en-us/entra/identity-platform/authentication-national-cloud) --- product: Access Management version: master --- # Configuring OpenAM Client Providers in Anypoint Platform > For the full documentation index, see: https://docs.mulesoft.com/llms.txt Register API clients through OpenAM 14 by configuring an OpenAM client provider in Anypoint Platform. Map OAuth2 authorization, token, validation, and client management endpoints along with admin token credentials to your deployment. Apply the OpenAM OAuth token enforcement policy to APIs through API Manager. > [!NOTE] Anypoint Platform doesn’t show plaintext client secrets or static authorization header > values for API clients registered through external client providers. A **Show** control appears, > but values remain masked. View your credentials in the external client provider. 1. Sign in to Anypoint Platform using an account that has the Organization Administrator permission. 2. Select **Access Management** from the ![gear icon](/mulesoft/current/en-us/access-management/_images/gear.svg) menu. 3. In the **Business Groups** menu, select your root organization. 4. In the Access Management navigation menu, click **Client Providers**. 5. Click **Add Client Provider**, and then select **OpenAM**. The **Add OpenAM client provider** page appears. 6. Fill in these required fields: - Version OpenAM version 14. - Admin Token Provider - Create URL The endpoint that creates an access token for OAuth authentication. - Username The name of the user requesting access. - Password The password of the user requesting access. - OAuth2 Authorization Provider, Authorize URL `/oauth2/authorize`, relative to the base path of the OpenAM application. Provide the absolute URL (base URI and path). - OAuth2 Token Provider, Create URL `/oauth2/access_token`, relative to the base path of the OpenAM application. Provide the absolute URL (base URI and path). - OAuth2 Token Validation Provider - Validate URL The token validation endpoint is `/oauth2/tokeninfo` relative to the base path of the OpenAM application. - Username Token Mapping Name of user with privileges for creating new clients within the target OpenAM system. - OAuth2 Client Provider - Create URL The URL at which the OpenAM client management API resources are served. Normally the endpoint is located at `/oauth2/client`. Confirm with your OpenAM administrator. - Delete URL URL destination for sending a DELETE request to delete a test client. - Scopes Supported OAuth capabilities, such as READ and WRITE. - Default Scopes Default OAuth capabilities to use in the event the client app does not specify any. 7. Save your configuration. ## See Also - [Configure OAuth 2.0 Provider in Mule](https://docs.mulesoft.com/api-manager/latest/mule-oauth-provider-landing-page) - [Apply the OpenAM OAuth Token Enforcement Policy to Your APIs](https://docs.mulesoft.com/mule-gateway/policies-included-openam-oauth-token-enforcement) - [Migrate Client Applications for APIs with External Client Providers in API Manager](https://docs.mulesoft.com/api-manager/latest/migrate-client-apps#migrate_with_external) --- product: Access Management version: master --- # Configuring OpenID Connect Client Management in Anypoint Platform > For the full documentation index, see: https://docs.mulesoft.com/llms.txt Configure an external OpenID Connect (OIDC) identity provider (IdP) to handle client management for your Anypoint Platform APIs. Use providers supporting the OIDC Dynamic Client Registration (DCR) standard, such as Salesforce, Okta, or OpenAM. API portals dynamically register client applications with your chosen external IdP when requesting access. Anypoint Platform supports client authentication using an Authorization Header or by using the private key JSON Web Token (JWT) method. With the private key method, during dynamic client registration, Anypoint Platform signs a JWT with a user-provided private key and sends it to the IdP as a client assertion. The IdP validates the signature using a pre-registered public key and, if successful, issues a short-lived access token used solely to register a new client. This approach enhances security by allowing you to control the token lifespan and restrict scopes to only those that are necessary. ## Configure Client Management 1. Sign in to Anypoint Platform using an account that has the Organization Administrator permission. 2. Select **Access Management** from the ![gear icon](/mulesoft/current/en-us/access-management/_images/gear.svg) menu. 3. In the Access Management navigation menu, click **Client Providers**. 4. Click **Add Client Provider**, and then select **OpenID Connect Dynamic Client Registration**. 5. Enter the values from your IdP’s configuration for **Dynamic Client Registration**: - **Issuer** URL that the OpenID provider asserts is its trusted issuer. - **Client Registration URL** URL to dynamically register client applications as a client application for your IdP. These are examples of client registration URLs, which are determined by your client provider, during registration:

URL Name

Okta Example URL

OpenAM Example URL

Salesforce Example URL

Base

https://example.okta.com/oauth2/v1

https://example.com/openam/oauth2

https://example.salesforce.com/services/oauth2

Client Registration

{BASE URL}/clients

{BASE URL}/connect/register

{BASE URL}/register

Authorize

{BASE URL}/authorize

{BASE URL}/authorize

{BASE URL}/authorize

Token

{BASE URL}/token

{BASE URL}/access_token

{BASE URL}/token

Token Introspection

{BASE URL}/introspect

{BASE URL}/introspect

{BASE URL}/introspect

- **Client Request Timeout (seconds)** The time that elapses before a client provider request times out. The minimum value is five seconds. The maximum value is 20 seconds. > [!NOTE] Anypoint Platform makes an HTTP call to the configured OIDC endpoints, and if there > is no response after five seconds, the HTTP call times out. 1. Select **Advanced Settings** for these options: - **Disable server certificate validation** Disables server certificate validation if your OpenID client management instance presents a self-signed certificate, or one signed by an internal certificate authority. - **Enable client deletion in Anypoint Platform** Enables deletion of clients created with this integration. - **Enable client deletion and updates in IdP** To use this option, you must also select the **Enable client deletion in Anypoint Platform** option. This option enables you to update and delete external clients in the configured IdP through an outbound call made by Anypoint Platform to `{clientRegistrationUrl}/{clientID}`. The `clientRegistrationUrl` is the value you configured in **Client Registration URL**. For example: `https://identity.example.com/oauth2/connect/register/6779ef20e75817b79602`. 6. In **Authentication Method**, complete the information for the type of authentication to use for this client provider: - **Authorization Header** The HTTP authorization header provides a static token that doesn’t expire to authenticate with a server. This header is required if the provider restricts registration requests to authorized clients. If you prefer to use short-lived bearer access tokens, use the OAuth 2.0 private key option instead.

Client Provider

Value

Okta

SSWS ${api_token}, where api_token is an API token created through Okta.

ForgeRock

Bearer ${api_token}, where api_token is an API token created through ForgeRock.

Salesforce

Bearer ${api_token}, where api_token is an API token created through Salesforce.

1. Select **Use OAuth2 private key jwt** to use a private key instead of an authorization header, and provide these values: - **Token Client ID** This is the unique identifier of the application (client ID) registered within your IdP. It’s used to identify the calling application when requesting a bearer token from Anypoint Platform during client registration. - **Token Client Private Key** This is the cryptographic key in PEM format used by Anypoint Platform to sign the JWT for authenticating with the IdP. The corresponding public key must be stored in the IdP in advance. When the IdP reads the signed JWT and validates the signature, the IdP issues an access token used for Anypoint Platform to register a new client in the IdP. - **Token Client API Scopes** The client API scopes define the specific permissions granted to the token client with the scopes to register new clients. 7. Enter the information for the **Token Introspection Client**: - **Client ID**: The client ID for an existing client in your IdP capable of introspection of _all_ tokens from all clients. - For Okta, this value is a "Confidential" client. - For ForgeRock, this value is a "Confidential" client. - For Salesforce, this value is a "Confidential" client. - **Client Secret**: The client secret that corresponds to the client ID. 8. Enter the information for **OpenID Connect Authorization URLs**: - **Authorize URL** URL where the user authenticates and grants OpenID Connect client applications access to the user’s identity. - **Token URL** URL that provides the user’s identity, encoded in a secure JSON Web Token. 9. Click **Create**. After this is successfully configured, you can apply the OpenID Connect OAuth Token Enforcement policy to your API Gateways through API Manager. Requesting API access through API portals dynamically generates client applications in the configured IDP that acts as a token provider. > [!NOTE] For Okta, the Okta admin must assign the dynamically generated clients to a user or a > group of users so they can receive access tokens by sending over the Client ID and Client Secret. ## Client Application Updates and Deletes Okta or another IdP might allow client modification and deletion independently, but this isn’t supported on Anypoint Platform. Instead, Anypoint Platform provides and supports hooks so you can implement API calls that are particular to your IdP. These examples show PUT and DELETE requests that Anypoint Platform makes. This is an example of the payload for a PUT (update) request: PUT /oauth2/connect/register/{{client\_id}} Accept: application/json Host: identity.example.com Authorization: Bearer access-token { "client\_id": "client\_id", "client\_secret": "some-secret", "redirect\_uris": \[ "https://example.com/" \], "grant\_types": \[ "authorization\_code" \], "token\_endpoint\_auth\_method": "client\_secret\_basic", "response\_types": \[ "code" \], "client\_name": "test-client-name" } - The `Authorization:` header is included as part of the request only if the `Authorization Header` under **Advanced settings** is configured. - The `client_id` request parameter that’s passed is the same as the `client_id` passed in the `PUT` request payload. - The `token_endpoint_auth_method` passed in the payload is always `client_secret_basic`. - Only the `Client Registration URL` and `Authorization Header` come from what is configured in OIDC **Client Provider**. > [!NOTE] `client_name` in the request maps to `name` on the inbound side. > The authorization method depends on the grant type. For example, if the grant type is > `implicit`, the `id_token` and `token` are returned. This example shows another DELETE request header: DELETE /oauth2/connect/register/{{client\_id}} Host: identity.example.com Authorization: Bearer access-token > [!IMPORTANT] Neither the `PUT` nor the `DELETE` work if the call is used directly against an IdP. > It’s intended for interception by pointing to an application under your control, so you can > implement the correct deletion and update APIs for their particular provider. ### Update External Clients Via the API You can use the Access Management API call `PUT /accounts/api/organizations/{orgId}/clientProviders/{clientProviderId}/clients/{clientId}` to update external clients. Use the optional `force` parameter to update Anypoint Platform internal client application records, regardless of whether the update to the external IdP is successful. Using this parameter ensures that the view Anypoint Platform has of the client application is current, even if there are issues communicating with the IdP. If you don’t use the `force` parameter, when updating an external client application via the Anypoint Platform API, Anypoint Platform first attempts to update the Identity Provider (IdP) and then updates its internal records only if the IdP update is successful. For more information, see the [Access Management API](https://dev-portal.mulesoft.com/apis/access-management.html) documentation. ## Supported Grant Types ### Pre-populated Grant Types in API Portal If you configure the optional **Issuer** field while setting up the OIDC Dynamic Client registration provider, Anypoint Platform autopopulates its UI with all the OIDC grant types supported by the provider, such as `client credentials`, `password`, and more. To verify the grant types your provider supports, check the provider’s discovery endpoint using `_$ISSUER_/.well-known/openid-configuration`, where `_$ISSUER_` is the issuer configured as the provider. If the client provider supports [RFC 8414, Obtaining Server Metadata](https://datatracker.ietf.org/doc/html/rfc8414#section-3) on the `_$ISSUER_/.well-known/oauth-authorization-server` endpoint, the endpoint is discovered and validated before merging grant types with `_$ISSUER_/.well-known/openid-configuration`. This process also enables the use of the Client Credentials grant type for Okta users. ### Update Grant Types If the **Issuer** is set and the `/.well-known` URL is available, you can go to an existing client provider, and save it again to update the grant types based on the `grant_types_supported` from your `/.well-known` metadata. The system fetches the `/.well-known` metadata when you create or update a client provider. ### Default Grant Types If the **Issuer** field isn’t configured or the provider’s discovery endpoint is unavailable, by default the Anypoint Platform UI lists these grant types when registering an API client application in an [Anypoint Exchange API portal](https://docs.mulesoft.com/exchange/): - Implicit - Authorization - Refresh Token > [!NOTE] You can select the Refresh Token grant type only if you have also selected the > Authorization grant type. ## See Also - [About OpenAM, OpenID Connect, or PingFederate OAuth Token Enforcement Policies](https://docs.mulesoft.com/mule-gateway/policies-included-openam-oauth-token-enforcement) - [About OAuth 2.0](https://docs.mulesoft.com/api-manager/latest/mule-oauth-provider-landing-page) - [How to find your Microsoft Entra ID tenant ID](https://learn.microsoft.com/en-us/entra/fundamentals/how-to-find-tenant). - [OpenAM 13.5 Developer’s Guide, Procedure 14.4 To Register a Relying Party Dynamically](https://docs.pingidentity.com/archive/) - [Okta OpenID Connect, Dynamic Client Registration](https://developer.okta.com/docs/api/openapi/okta-oauth/oauth/client) - [OpenAM 13.5 Administration Guide, Procedure 14.5 To Register a Relying Party Dynamically](https://cdn-docs.pingidentity.com/archive/pdf/openam/13.5/OpenAM-13.5-Admin-Guide.pdf) - [Okta OpenID Connect, Dynamic Client Registration](https://developer.okta.com/docs/api/openapi/okta-oauth/oauth/tag/Client/) - [Okta OpenID Connect & OAuth 2.0 API](https://developer.okta.com/docs/api/openapi/okta-oauth/guides/overview/) - [AM 5 OAuth 2.0 Guide, 3.1. OAuth 2.0 Client and Resource Server Endpoints](https://cdn-docs.pingidentity.com/archive/pdf/am/5/AM-5-Oauth2-Guide.pdf?_gl=1*1vvi2cj*_gcl_au*MjAxNDYzMjg5Ni4xNzc2MzcxMDA3*_ga*MTYwNDgyOTczOC4xNzc2MzcwOTk5*_ga_V94KKVLZPT*czE3NzYzNzA5OTkkbzEkZzEkdDE3NzYzNzE0MDAkajYwJGwwJGg4OTk1NTUwMDI) - [How to reset secrets for client applications when using external client management](https://help.salesforce.com/s/articleView?id=001115835&type=1) --- product: Access Management version: master --- # Configuring OpenID Connect Identity Management in Anypoint Platform > For the full documentation index, see: https://docs.mulesoft.com/llms.txt Configure OpenID Connect identity management in Anypoint Platform using dynamic or manual client registration. Anypoint Platform supports integration with Okta, Salesforce, OpenAM, and PingFederate, as well as any identity provider that follows the OpenID Connect specification. You can use one of these identity management procedures for client registration in OpenID Connect: - Dynamic registration - Manual registration Anypoint Platform supports the following registrations: - Clients created dynamically in Okta and OpenAM - Clients created manually in Salesforce, Okta, OpenAM, and PingFederate MuleSoft has officially tested the integration with these identity providers. Because Anypoint Platform supports the OpenID Connect Protocol, any identity provider that supports the protocol can integrate unless they diverge from the [specification](https://openid.net/specs/openid-connect-core-1_0.html). If you already configured Anypoint Platform as a client application in your identity provider, perform manual registration. Otherwise, if your identity provider supports dynamic client registration, perform dynamic registration. During registration, provide several URLs. The following table contains examples of the URLs to provide, depending on your provider, during registration.
URL NameOkta Example URLSalesforce Example URLOpenAM Example URLPingFederate Example URL

Base

https://example.okta.com/oauth2/v1

https://domain.my.salesforce.com/services/oauth2

https://example.com/openam/oauth2

https://example.com:9031

Client Registration

{BASE URL}/clients

{BASE URL}/clients

{BASE URL}/connect/register

N/A

Authorize

{BASE URL}/authorize

{BASE URL}/authorize

{BASE URL}/authorize

{BASE URL}/as/authorization.oauth2

Token

{BASE URL}/token

{BASE URL}/token

{BASE URL}/access_token

{BASE URL}/as/token.oauth2

User Info

{BASE URL}/userinfo

{BASE URL}/userinfo

{BASE URL}/userinfo

{BASE URL}/idp/userinfo.openid

## Configure OpenID Connect Dynamically 1. Sign in to Anypoint Platform using an account that has the Organization Administrator permission. 2. Select **Access Management** from the ![gear icon](/mulesoft/current/en-us/access-management/_images/gear.svg) menu. 3. In the **Business Groups** menu, select your root organization. 4. In the Access Management navigation menu, click **Identity Providers**. 5. In the **Identity Management** page, select **OpenID Connect**. The External Identity - Identity Management OpenID Connect form appears. 6. Fill in the following required fields after obtaining values from your identity provider’s configuration: - Client Registration URL The URL to dynamically register Anypoint as a client application for your identity provider. - Authorize Header The authorization header for dynamic client registration request. This is an optional field under the Advanced Settings link. This header is required if the provider restricts registration requests to authorized clients. - Okta: This value is `SSWS ${api_token}`, where `api_token` is an API token created through Okta. - OpenAM: This value is `Bearer ${api_token}`, where `api_token` is an API token created through OpenAM. - Authorize URL The URL where the user authenticates and grants OpenID Connect client applications access to the user’s identity. - Token URL The URL that provides the user’s identity encoded in a secure JSON Web Token. - User Info URL The URL that returns user profile information to Anypoint. 7. Save your configuration. 8. Log out and navigate to your organization’s SSO URL, for example: `https://anypoint.mulesoft.com/accounts/login/{yourOrgDomain}` 9. Log in through your identity provider to test the configuration. > [!NOTE] The dynamically registered application at the identity provider has only default settings. > If you want to configure additional functionalities (such as group mappings), update the settings > on the provider side. Anypoint Platform doesn’t support configuring dynamically registered > applications. ## Configure OpenID Connect Manually 1. Sign in to Anypoint Platform using an account that has the Organization Administrator permission. 2. Select **Access Management** from the ![gear icon](/mulesoft/current/en-us/access-management/_images/gear.svg) menu. 3. In the Access Management navigation menu, click **Identity Providers**. 4. From Identity Management, select **OpenID Connect**. The External Identity - Identity Management OpenID Connect form appears. 5. Click **Use manual registration** under Client Registration URL. 6. Create a client application for the Anypoint Platform inside your Identity Provider. - Your Identity Provider requires a redirect URI for redirecting authenticated users. Use the automatically generated redirect URI. - Inside your Identity Provider, make sure that your client’s supported scopes include `openid`, `profile`, and `email`. - Inside your Identity Provider, make sure that your client uses the `authorization_code` grant type. - Store your Client ID and Client Secret values in a secure place and enter these values in the next step. 7. Fill in the required fields after obtaining them from your identity provider’s configuration: - Client ID The unique identifier that you provided for your manually created client application. - Client Secret The password, or secret, for authenticating your Anypoint Platform client application with your Identity Provider. - Authorize URL The URL where the user authenticates and grants OpenID Connect client applications access to the user’s identity. - Token URL The URL that provides the user’s identity encoded in a secure JSON Web Token. - User Info URL The URL that returns user profile information to the client app. - OpenID Connect Issuer The location of the OpenID Provider. For most providers, `/.well-known/openid-configuration` is appended to the issuer to generate the metadata URL for openID Connect specifications. For Salesforce, you must provide the value for `issuer`. 8. Save your configuration. 9. Log out and navigate to your organization’s SSO URL, for example: `https://anypoint.mulesoft.com/accounts/login/{yourOrgDomain}` 10. Log in through your identity provider to test the configuration. ## See Also - [Okta OpenID Connect](https://developer.okta.com/docs/api/openapi/okta-oauth/guides/overview/) - [Dynamic Client Registration](https://developer.okta.com/docs/api/openapi/okta-oauth/oauth/client) - [Getting a Token](https://developer.okta.com/docs/guides/create-an-api-token/) - [Get a User](https://developer.okta.com/docs/api/openapi/okta-management/management/tags/user) - [Salesforce OAuth 2.0 Web Server Authentication Flow](https://help.salesforce.com/s/articleView?language=en_US&id=remoteaccess_oauth_web_server_flow.htm) - [Salesforce OpenID Connect, Authentication Request](https://help.salesforce.com/s/articleView?language=en_US&id=sso_provider_openid_connect.htm) - [Salesforce OAuth Refresh Token Process](https://developer.salesforce.com/docs/atlas.en-us.api_rest.meta/api_rest/intro_oauth_and_connected_apps.htm) - [Salesforce Understanding Username-Password OAuth](https://developer.salesforce.com/docs/atlas.en-us.api_rest.meta/api_rest/intro_oauth_and_connected_apps.htm) - [AM 5 OAuth 2.0 Guide, Section 3.1. OAuth 2.0 Client and Resource Server Endpoints](https://docs.pingidentity.com/archive/) - [AM 5 OpenID Connect 1.0 Guide, Section 2.4. To Register a Relying Party Dynamically](https://docs.pingidentity.com/archive/) - [AM 5 OpenID Connect 1.0 Guide, Section 3.1. Authorizing OpenID Connect 1.0 Relying Parties](https://docs.pingidentity.com/archive/) - [PingFederate Authorization Endpoint](https://docs.pingidentity.com/pingfederate/13.0/administrators_reference_guide/pf_enable_disable_express.html) - [PingFederate Token Endpoint](https://docs.pingidentity.com/pingfederate/13.0/administrators_reference_guide/pf_enable_disable_express.html) - [Migrate Client Applications for APIs with External Client Providers in API Manager](https://docs.mulesoft.com/api-manager/latest/migrate-client-apps#migrate_with_external) --- product: Access Management version: master --- # Configuring PingFederate Client Management in Anypoint Platform > For the full documentation index, see: https://docs.mulesoft.com/llms.txt Configure PingFederate versions 6 through 8 as a client provider in Anypoint Platform to manage OAuth 2.0 client authentication. Map authorization, token, and client management endpoints to your PingFederate deployment. Anypoint Platform supports only PingFederate versions 6 through 8. For versions 9 or later, you can configure the PingFederate client provider as an OIDC provider by following the instructions in [Configure OpenID Connect Client Management](https://docs.mulesoft.com/access-management/configure-client-management-openid-task). When you configure client provider URLs, use the endpoint `/pf-ws/rest/oauth/clients` and not `/as/clients.oauth2`. Do not use PingFederate’s dynamic client registration URL for this configuration. ## Manage a PingFederate Client Provider To edit existing PingFederate client providers: 1. Sign in to Anypoint Platform using an account that has the Organization Administrator permission. 2. Select **Access Management** from the ![gear icon](/mulesoft/current/en-us/access-management/_images/gear.svg) menu. 3. In the Access Management navigation menu, click **Client Providers**. 4. Click the name of the PingFederate client to edit. 5. Edit these fields: - OAuth2 Authorization Provider, Authorize URL The authorization endpoint defined by OAuth 2.0 and used to interact directly with resource owners, authenticate owners, and obtain owner authorization. For example: `https://ec2-55-88-144-83.us-west-2.compute.amazonaws.com:9031/as/authorization.oauth2` - OAuth2 Token Provider, Create URL The endpoint that creates an access token for OAuth authentication. For example: `https://ec2-55-88-144-83.us-west-2.compute.amazonaws.com:9031/as/token.oauth2` - OAuth2 Token Validation Provider - Validate URL The token endpoint defined in the OAuth 2.0 specification where the client obtains an access token and possibly a refresh token by presenting its authorization grant. For example: `https://ec2-55-88-144-83.us-west-2.compute.amazonaws.com:9031/as/token.oauth2` - Username Token Mapping The name of the user requesting access. For example, the username mapping token uid. - Client Id The optional client identifier that is the username of the client being authenticated using HTTP Basic Authentication. - Client Secret The optional client password of the client being authenticated using HTTP Basic Authentication. - OAuth 2 Client Provider - Create URL The URL at which the PingFederate client management API resources are served. For example: `https://ec2-55-88-144-83.us-west-2.compute.amazonaws.com:9031/pf-ws/rest/oauth/clients` The base URL is the base URL for your server. Confirm this with your PingFederate administrator. - Delete URL URL destination for sending a DELETE request to delete a test client. For example: `https://ec2-55-88-144-83.us-west-2.compute.amazonaws.com:9031/pf-ws/rest/oauth/clients/{{client_id}}` - Username Name of user with privileges for creating new clients within the target PingFederate system. - Password Password of user with privileges for creating new clients within the target PingFederate system. 6. Select **Bypass approval page** if you already have approval. 7. Click **Save**. ## See Also - [PingFederate OAuth 2.0 Endpoints](https://docs.pingidentity.com/pingfederate/latest/developers_reference_guide/pf_oauth_20_endpoints.html) - [PingFederate Web Service Interfaces and APIs](https://docs.pingidentity.com/pingfederate/latest/developers_reference_guide/pf_web_service_interface_api.html) - [About OAuth 2.0](https://docs.mulesoft.com/api-manager/latest/mule-oauth-provider-landing-page) - [OpenAM and PingFederate OAuth Token Enforcement Policies](https://docs.mulesoft.com/mule-gateway/policies-included-openam-oauth-token-enforcement) - [Migrate Client Applications for APIs with External Client Providers in API Manager](https://docs.mulesoft.com/api-manager/latest/migrate-client-apps#migrate_with_external) --- product: Access Management version: master --- # Configuring SAML SSO for Anypoint Platform > For the full documentation index, see: https://docs.mulesoft.com/llms.txt Use SAML 2.0 with your external identity provider (IdP) to authenticate users and enable single sign-on (SSO) to Anypoint Platform. Configure issuer details, sign-on and sign-off URLs, public key, and audience in the Identity Management form, then test the connection. Configuring SAML for SSO involves: - Beginning with a configured SAML IdP - Navigating to and completing the **External Identity - Identity Management SAML 2.0** form in Anypoint Platform, and optionally configuring some advanced settings - Saving and testing your new configuration ## Before You Begin - Your Anypoint Platform organization must be set up as your audience. - The assertion consumer service must be set to send a `POST` request to `https://anypoint.mulesoft.com/accounts/login/:org-domain/providers/:providerId/receive-id`. Note that `:providerId` is available only after you create the provider configuration. > [!NOTE] > > - If you are using the Anypoint Platform EU Control Plane, the endpoint is > `https://eu1.anypoint.mulesoft.com/accounts/login/:org-domain/providers/:providerId/receive-id`. > > - If you are using the Anypoint Platform Gov Cloud, the endpoint is > `https://gov.anypoint.mulesoft.com/accounts/login/:org-domain/providers/:providerId/receive-id`. ## Configure SAML in Identity Management 1. Sign in to Anypoint Platform using an account that has the Organization Administrator permission. 2. Select **Access Management** from the ![gear icon](/mulesoft/current/en-us/access-management/_images/gear.svg) menu. 3. In the Access Management navigation menu, click **Identity Providers**. 4. Select **Identity Providers** > **SAML 2.0**. 5. In the **Configurations** tab, complete the required fields of the **Identity Management SAML 2.0** form: - **Sign On URL** Redirect URL provided by the IdP for signin, for example: `https://example.com/sso/saml`. - **Sign Off URL** URL to redirect signout requests, so users both sign out of the Anypoint Platform and have their SAML user’s status set to signed out. - **Issuer** The SAML IdP EntityID (Issuer) URI of the identity provider that sends SAML assertions. This must match the `` value in the IdP’s SAML metadata and the Issuer in its SAML assertions. - **Public Key** Public key provided by the IdP, which is used to sign the SAML assertion. It’s the "X509Certificate" value in the SAML Response. - **Audience** An arbitrary string value that identifies your Anypoint Platform organization. The typical value for this string is `.anypoint.mulesoft.com`. - **Single Sign-On Initiation** Specify whether SSO can be initiated by the Anypoint Platform, your identity provider (for example, Okta), or both. - The **Service Provider Only** option allows only the Anypoint Platform to initiate SSO. - The **Identity Provider Only** option allows only your external identity provider to initiate SSO. - The **Both** option allows either Anypoint Platform or your external identity provider to initiate SSO. The default value for this setting for newly configured identity provider configurations is **Both**. 6. Optionally, expand **Advanced settings**, and provide the following values: - **Username Attribute** Field name in the SAML `AttributeStatements` that maps to username. If no value is configured, the `NameID` attribute of the SAML `Subject` is used (Note: this is outside the SAML `AttributeStatements`). - **First Name Attribute** Field name in the SAML `AttributeStatements` that maps to `First Name`. - **Last Name Attribute** Field name in the SAML `AttributeStatements` that maps to `Last Name`. - **Email Attribute** Field name in the SAML `AttributeStatements` that maps to `Email`. - **Group Attribute** Field name in the SAML `AttributeStatements` that maps to `Group`. - **Require encrypted SAML assertions** If enabled, the SAML assertions sent from the IdP must be encrypted and follow the guidelines mentioned in the [Prerequisites](https://docs.mulesoft.com/access-management/sso-prerequisites-about). 7. Click **Create**. 8. Sign out of Anypoint Platform, navigate to the sign-on URL you entered in the **Identity Management SAML 2.0** form, and then sign in through your identity provider to test the configuration. ## Rotate a SAML Key As a security best practice, many organizations rotate the key used to encrypt SAML 2.0 assertions. With the Key Rotation feature, Anypoint Platform can generate a new key, or you can upload a public and private key pair (up to three keys). When you want to rotate a key, you can designate a new _primary key_ in Anypoint Platform and your IdP, and you can revoke the obsolete key to remove it from the rotation. The keys that you create or upload to Anypoint Platform must also exist in your IdP. All keys present in Anypoint Platform can decrypt SAML 2.0 assertions sent by your IdP. However, only the primary key is used by Anypoint Platform to sign SAML 2.0 AuthnRequests and SLO requests; the primary key must be configured in your IdP to validate the signatures. > [!NOTE] If you are migrating from the default Anypoint Platform SSO certificate to a new > certificate, you must update the Assertion Consumer Service (ACS) URL in your IdP. Only the new > ACS URL supports the keys generated by the key rotation feature. If your ACS URL already follows > the pattern of `…​/accounts/login/:org-domain/providers/:providerId/receive-id`, you do not need > to change the ACS URL. ### Add Keys for Key Rotation When you use the key rotation feature, you must have keys available in Anypoint Platform for your IdP to use. Anypoint Platform enables you to generate new keys or upload existing public/private key pairs. #### Generate a New Key 1. Sign in to Anypoint Platform using an account that has the Organization Administrator permission. 2. Select **Access Management** from the ![gear icon](/mulesoft/current/en-us/access-management/_images/gear.svg) menu. 3. In the Access Management navigation menu, click **Identity Providers**. 4. Next to a SAML 2.0 IdP, click **Edit**. 5. Click the **Anypoint Keys** tab. 6. Click **\+ New key** and select **Generate**. A newly generated key appears in the list of keys. #### Upload an Existing Private and Public Key Pair 1. Sign in to Anypoint Platform using an account that has the Organization Administrator permission. 2. Select **Access Management** from the ![gear icon](/mulesoft/current/en-us/access-management/_images/gear.svg) menu. 3. In the Access Management navigation menu, click **Identity Providers**. 4. Next to a SAML 2.0 IdP, click **Edit**. 5. Click the **Anypoint Keys** tab. 6. Click **\+ New key**, and select **Upload**. 7. In the **Private key** field, paste your private key. 8. In the **Public key** field, paste your certificate. 9. Click **Upload**. The key you uploaded appears in the list of keys. ### Rotate the Primary Key Because you can store up to three keys, you must designate a _primary key_ to be used for signing requests from Anypoint Platform. Before reassigning the primary key, make sure your IdP can access the key that you intend to use. 1. Sign in to Anypoint Platform using an account that has the Organization Administrator permission. 2. Select **Access Management** from the ![gear icon](/mulesoft/current/en-us/access-management/_images/gear.svg) menu. 3. In the Access Management navigation menu, click **Identity Providers**. 4. Next to a SAML 2.0 IdP, click **Edit**. 5. Click the **Anypoint Keys** tab. 6. Next to the key that you want to make primary, click **…​** and select **Use as primary key…​**. 7. Click **Apply**. ### Revoke a Key To help ensure security, revoke a key that you have already used as the primary key. Before you revoke a key, make sure your IdP is not using the key. Note that when you revoke a public key, Anypoint Platform also revokes the corresponding private key. For security purposes, you cannot retrieve a key that has been revoked. 1. Sign in to Anypoint Platform using an account that has the Organization Administrator permission. 2. Select **Access Management** from the ![gear icon](/mulesoft/current/en-us/access-management/_images/gear.svg) menu. 3. In the Access Management navigation menu, click **Identity Providers**. 4. Next to a SAML 2.0 IdP, click **Edit**. 5. Click the **Anypoint Keys** tab. 6. Next to the key that you want to revoke, click **…​** and select **Revoke**. 7. Click **Revoke**. ## Import SAML Metadata When creating a new SAML 2.0 configuration, you can upload an XML file containing your identity provider’s SAML 2.0 metadata to Anypoint Platform using the **Import IdP Metadata** link. After you upload the file, its values automatically populate the **Identity Management SAML 2.0** form. When you upload an XML file to import your metadata: - The file must be smaller than 16 KB. - If you upload an XML file that contains more than one entry, Anypoint Platform uses the first identity provider configuration. - Anypoint Platform does not check the validity of the values in the XML that you upload. Verify that your identity configuration is correct before creating the IdP configuration. ## Export SAML Metadata If your IdP supports uploading service-provider metadata, click the **Anypoint service provider metadata** link to download your SAML configuration settings in an XML file. You can then upload this file to your IdP to configure Anypoint Platform. You must have a SAML 2.0 identity configuration to export this data. ## SSO Redirect Process Using Cookies Anypoint Platform uses cookies to make sure that SSO users are redirected to the same location from which they initiated their signin. 1. When a user signs in to Anypoint Platform, a cookie is created for the signin session: `mulesoft.sess=xxxxx`. The cookie contains the location where the user initiated the signin, such as the Anypoint Platform page where the user began signing in. 2. The cookie is passed to the user’s browser. 3. The user is directed to their SSO provider for authentication. 4. After the user is authenticated using SSO, the provider directs the user back to Anypoint Platform with the authorization decision SAML response. 5. The session cookie, `mulesoft.sess=xxxxx`, is passed from the browser, which redirects the user back to the location where they initiated the signin process. 6. After the user successfully signs in to Anypoint Platform, the `mulesoft.sess` cookie returns to its default value, based on the OWASP standard. > [!NOTE] If a user initiates SSO from an Anypoint Exchange public portal, they are directed to > Anypoint Exchange after signing in. Returning to the originating public portal after SSO isn’t > currently supported. Users can also be redirected based on their permissions. This occurs when: - The browser does not pass a cookie. - The cookie has expired. - The cookie is set to the default value. In these cases, a user with the Organization Administrator permission is redirected to the Anypoint Platform landing page. Users who don’t have the Organization Administrator permission are directed to Anypoint Exchange. ## Update a SAML Identity Provider Organization administrators can update existing SAML providers. However, when you update `Issuer` or `Audience`, you effectively switch to a different IdP, which can cause issues such as unwanted user duplication. For more information, see [External identity migration - How to prevent duplicate users being created](https://help.salesforce.com/s/articleView?id=001116895&type=1). ## View Limits for a SAML Identity Provider Each configured SAML IdP has a **Limits** section that shows how close it is to hitting limits imposed by Anypoint Platform. To view limits: 1. In the Access Management navigation menu, click **Identity Providers**. 2. Click the SAML IdP for which you want to view limits. 3. Click the **Limits** tab. For more information on limits in Access Management, see [Limits](https://docs.mulesoft.com/access-management/troubleshooting-anypoint-platform-access#access-management-limits). ## See Also - [Configuring Single Signout](https://docs.mulesoft.com/access-management/single-log-out-task) --- product: Access Management version: master --- # Configuring Single Signout > For the full documentation index, see: https://docs.mulesoft.com/llms.txt As Administrator, you can configure single signout if you use SAML. OpenID Connect doesn’t support single signout. Using single signout, a user or user agent can sign out of an authenticated environment and make sure that both service providers and identity servers process the signout correctly. The following procedure shows how to perform single signout and control where the user is redirected after signing out. To redirect the user to a different page, set up the redirect in your PingFederate configuration by adding a `redirect_uri` query parameter to the SLO Service URL. Anypoint Platform routes the user to that page rather than to the Anypoint Platform sign-in page. 1. In PingFederate, for example, click the SP Configuration for the Anypoint Platform. 2. In **Browser SSO > Configure Browser SSO > SAML Profiles**, make sure that these fields are set: - IdP-Initiated SSO - IdP-Initiated SLO - SP-Initiated SLO 3. In **Protocol Settings > Configure Protocol Settings**, configure a SLO Service URL with the following values: - Binding: POST - Endpoint URL Set `PARTNER_SP_ID` to the correct value: `https://anypoint.mulesoft.com/accounts/logout/receive-id` 4. Redirect users to your sign-in page using the following URL: https://anypoint.mulesoft.com/accounts/logout/receive-id?redirect\_uri=https%3A%2F%2Fanypoint.mulesoft.com%2Faccounts%2Flogin%2Fyour-domain Alternatively, redirect users to your portal page using the following URL: https://anypoint.mulesoft.com/accounts/logout/receive-id?redirect\_uri=https%3A%2F%2Fanypoint.mulesoft.com%2Fapiplatform%2Fyour-domain%2F%23%2Fportals 5. In **Allowable SAML Bindings**, click **Redirect**. 6. In **Encryption Policy**, choose either **none** or **the entire assertions**, then save and exit Protocol Settings and Browser SSO. 7. When viewing the SP Configuration for Anypoint Platform, go to **Credentials > Configure Credentials**. 8. Set **Signature Verification Settings > Manage Signature Verification Settings > Trust Model to Unanchored**, and import the certificate from the following location: `http://docs.mulesoft.com/downloads/access-management/anypoint-platform-slo.pem` 9. Make this certificate the active certificate. ## See Also - [Configure SAML for SSO](https://docs.mulesoft.com/access-management/conf-saml-sso) --- product: Access Management version: master --- # Configuring Teams in Anypoint Platform > For the full documentation index, see: https://docs.mulesoft.com/llms.txt Create child teams under the root team and configure those teams to have different sets of permissions based on the needs of the respective team members. Every user in your organization is automatically a member of the root team and each member inherits all the permissions of the root team. When you configure permissions in your organization, assign only permissions you want every user in the root team to have. After you create child teams and assign permissions, you can add users to each of your teams according to what permissions the users in the team need. ## Access Teams 1. Sign in to Anypoint Platform using an account that has the Organization Administrator permission. 2. Select **Access Management** from the ![gear icon](/mulesoft/current/en-us/access-management/_images/gear.svg) menu. 3. In the Access Management navigation menu, click **Teams**. ## Create a Child Team Organization Administrators for the root organization can create child teams at any business group level. If you’re the Organization Administrator or maintainer for a business group, you can create child teams in the business group you have the Organization Administrator permission in and become the maintainer for that team. All child teams inherit user permissions from their parent teams, and you can configure additional permissions. 1. Click **Create Team**. 2. Enter a unique and intuitive name for your child team. You can use only alphanumeric characters, hyphens, underscores, and spaces. The character limit is 255. 3. Select a parent team. 4. Select **Save**. Your new child team appears under its parent team in the list of teams. You can select any parent team in that list and navigate to its **Child teams** tab to see a list of all that parent team’s child teams. After you create child teams and add any additional permissions needed for the team, you can invite new users to the team using email invitations or by using the **Teams** feature interface. ## Manage Team Permissions Your organization’s root team is **Everyone at ** and doesn’t have any permissions assigned. You must have the Organization Administrator permission in the root organization to add and configure permissions for the root team and all its child teams. To manage child teams' permissions, you must have the Organization Administrator permission or be a maintainer in that team. If you invite users to **Everyone at ** without assigning any permissions to that team, your users can’t execute tasks or view assets in your organization. ### Add Permissions to Teams Every user in your organization is automatically a member of the root team and each inherits all the permissions of the root team. When you add permissions in your organization, assign only permissions you want every user in the root team to have, for example, viewer permissions. Then add additional permissions to the child teams. 1. Click the team to configure permissions for. 2. Select the **Permissions** tab, and click **Add Permissions**. 3. Select the permissions to add and click **Next**. The list of **Permissions** includes all permissions, even if they are already assigned to users. If you add a permission that’s already assigned, there is no effect. 4. Select the business groups and environments (if it’s enabled for the permission) to apply the permissions to and click **Next**. 5. Review the permissions and the business groups and environments they apply to, and then click **Add Permissions**. ### View Team Permissions The permissions you added to the team are listed in the **Permissions** tab for your team. 1. Select the team to view limits for. 2. Select the **Permissions** tab. 3. Switch on **Show inherited permissions** to see the permissions the child team inherited from its parent team. ### View Team Permissions Limits Each team, including the root team, has a **Limits** section that shows how close the team is to reaching limits imposed by Anypoint Platform. 1. Click the team to view limits for. 2. Select the **Limits** tab. > [!NOTE] The number of permissions used might include internal permissions granted automatically by > the system, which aren’t always visible in the UI. For more information on limits in Access Management, see [Limits](https://docs.mulesoft.com/access-management/troubleshooting-anypoint-platform-access#access-management-limits). ## Manage Team Users If you have the Organization Administrator permission in your root organization, you can add users to existing teams using three methods: - The **Teams** feature interface - Sending an invitation to a new user via email - External group mapping ### Add Users Via the Teams Interface When you add a user to a team, you can select whether that user is a team maintainer or a team member. You must have the Organization Administrator permission or be a team maintainer yourself to modify team members and team maintainers. Team maintainers can manage only the teams and child teams they are maintainers for (not the root team). Team maintainers can: - Change the team name - Add or remove members from the team - Add or remove additional team maintainers - Move the team under different parent teams they are teams maintainers for - Delete the team You can designate a team maintainer to delegate team maintenance responsibilities to users without giving them full organization administrator permissions, or you can remove the team maintainer designation and convert users back to team members. 1. Sign in to Anypoint Platform using an account that is a team maintainer of the team you want to modify. 2. Select **Access Management** from the ![gear icon](/mulesoft/current/en-us/access-management/_images/gear.svg) menu. 3. In the Access Management navigation menu, click **Teams**. If you are only a team maintainer and do not have other permissions that apply to your root organization, you are redirected to the **Teams** section of Access Management automatically. 4. In the **Teams** page, select the team to add a user to. 5. Click **Add members**. 6. Enter the name of each user to add to the team. 7. Select the membership type that you want to assign to each user: - **Member** Team members receive the team’s permissions. - **Maintainer** A user who is added as a team maintainer receives team maintainer permissions as soon as you confirm their membership. 8. Click **Create**. ### Add Users Via Email Invitations When you send an email to invite a new user to your organization, the user is automatically added to your organization’s root team. You can also specify additional teams to automatically add the user to. For more information about inviting a user to an existing team via email, see [Inviting a User to Anypoint Platform](https://docs.mulesoft.com/access-management/users#inviting-a-user-to-anypoint-platform). ### Add Users Via External Group Mapping If you use single sign-on (SSO) using SAML, OIDC, or LDAP, you can map SSO users to teams. For more information, see [Map SSO Users to Teams](https://docs.mulesoft.com/access-management/map-users-roles-teams). ## Change the Name of Your Team 1. Sign in to Anypoint Platform using an account that has the Organization Administrator permission or is a team maintainer of the team you want to modify. 2. Select **Access Management** from the ![gear icon](/mulesoft/current/en-us/access-management/_images/gear.svg) menu. 3. In the Access Management navigation menu, click **Teams**. 4. Click the **Settings** tab. 5. In **Name**, enter a new name for your team. You can use only alphanumeric characters, hyphens, commas, periods, and spaces. The character limit is 255. 6. Click **Save changes**. Your team is renamed. ## Move Your Team 1. In the team to move, select **Settings**. 2. In **Parent Team**, select the new parent team. 3. Click **Save Changes**. Your team and its child teams now reside under the parent team you selected. ## Delete a Team You must have the Organization Administrator permission to delete a team. After you delete a team, the team can’t be restored. You can’t delete the root team that represents your entire root organization. 1. Sign in to Anypoint Platform using an account that has the Organization Administrator permission. 2. Select **Access Management** from the ![gear icon](/mulesoft/current/en-us/access-management/_images/gear.svg) menu. 3. Click **…​** next to the team that you want to delete. 4. Select **Delete…​**. 5. Enter the name of the team that you want to delete and click **Delete**. ## See Also - [Using Teams to Manage User Permissions](https://docs.mulesoft.com/access-management/teams) - [Example Teams Structure](https://docs.mulesoft.com/access-management/teams-example) - [Mapping Single Sign-On Users to Roles or Teams in Anypoint Platform](https://docs.mulesoft.com/access-management/map-users-roles-teams) --- product: Access Management version: master --- # Connected Apps in Anypoint Platform > For the full documentation index, see: https://docs.mulesoft.com/llms.txt Connected apps provide OAuth 2.0 and OpenID Connect–based integration for external applications with restricted access to your Anypoint Platform organization. They enforce least‑privilege and provide administrative control over each app’s permissions and data exposure. Connected apps: - Establish a trusted relationship with the external application. - Manage and enforce the specific permissions granted to the external application. - Provide secure and temporary access to your Anypoint Platform resources without exposing sensitive information. Actions taken by connected apps are audited, and you can revoke access at any time. ## Authentication and Authorization Anypoint Platform supports OAuth 2.0 and OpenID Connect to authorize apps to access data within Anypoint Platform. OAuth (Open Authorization) is an open protocol that provides secure API authorization from applications in a simple and standardized way. OAuth can authorize access to resources without revealing user credentials to apps. OpenID Connect identifies the end user and obtains information to pass to OAuth 2.0 connected apps. For more information, see [OAuth 2.0](https://oauth.net/2/) and [OpenID Connect](https://openid.net/developers/how-connect-works/). ## Access and Authorization Use connected apps to create a seamless authentication experience for end users. Connected apps address use cases for these types of users: - An [organization administrator](https://docs.mulesoft.com/access-management/connected-apps-org-admin) can control how their organization’s data is used by allowlisting apps, revoking access, and disabling this feature for the entire organization. - An [organization administrator who is developing a connected app](https://docs.mulesoft.com/access-management/connected-apps-developers#developers) can register new (and manage existing) apps at the root organization or business group level. - An [end user](https://docs.mulesoft.com/access-management/connected-apps-end-users#end-users) can authorize apps to access particular information, such as viewing assets in Anypoint Exchange. There are two types of connected apps, each supporting different grant types:
TypeDescriptionSupported grant typesExample use cases

App that acts on behalf of a user

Authorized by a user to act on their behalf

  • Authorization Code

  • Password

  • JWT Bearer

Productizing additional third-party applications on top of Anypoint Platform.

App that acts on its own behalf

Acts on its own behalf without impersonating a user. The app can be used only in the organization where it’s created.

Client Credentials

Automation scenarios such as building or accessing CI/CD pipelines without user intervention.

## How Connected Apps Work When you register an external application with Anypoint Platform, it receives a unique client identity. You then specify exactly which APIs and data the app has permission to access. When the external app requests access, Anypoint Platform verifies its identity and issues a temporary OAuth 2.0 token. This token grants access only to the permitted resources for a limited time, without exposing user credentials. ## See Also - [Anypoint Platform Connected Apps for Organization Administrators](https://docs.mulesoft.com/access-management/connected-apps-org-admin) - [Anypoint Platform Connected Apps for Developers](https://docs.mulesoft.com/access-management/connected-apps-developers) - [Anypoint Platform Connected Apps for End Users](https://docs.mulesoft.com/access-management/connected-apps-end-users) --- product: Access Management version: master --- # Connecting a Trusted Salesforce Organization to Anypoint Platform > For the full documentation index, see: https://docs.mulesoft.com/llms.txt Establish a tenant (organization to organization) trust relationship between your Anypoint Platform organization and a Salesforce organization to enable secure data sharing and centralized capability management. After you establish this link between organizations, the two environments trust each other and can share permissions. The connection process uses two unique tenant keys (one from each organization) and involves the Anypoint Platform organization administrator and the Salesforce organization administrator. After you complete the connection process, you can enable features such as MuleSoft API Catalog for Salesforce and Integration Intelligence. Ways to establish a tenant relationship include: - A Salesforce organization is provisioned with the tenant relationship to an Anypoint Platform organization established. In this case, the Anypoint Platform organization administrator only needs to [enable the existing connection](https://docs.mulesoft.com/access-management/managing-connected-salesforce-orgs#enable-disable-connection) in Anypoint Platform. - The Anypoint Platform organization administrator initiates the tenant relationship in Anypoint Platform and the Salesforce organization administrator completes the setup in Salesforce. ## Before You Begin - Anypoint Platform organization administrators must have the **Organization Administrator** permission at the root organization level. - Salesforce organization administrators must have the **System Administrator** user profile. ## Choose Your Scenario Depending on whether one person holds both the Anypoint Platform and Salesforce organization administrator roles or two people split the roles, follow the appropriate scenario. ### One Person Manages Both Organizations If you’re the organization administrator for both the Anypoint Platform and Salesforce organizations: 1. Start in Salesforce by [getting the Salesforce organization tenant key](#get-salesforce-tenant-key). 2. In Anypoint Platform, [connect with a Salesforce organization](#connect-orgs). 3. In Salesforce, [complete the organization connection process](#complete-organization-connection). ### Different People Manage the Organizations This diagram shows the high-level flow for connecting Salesforce and Anypoint Platform organizations when the process involves separate administrators for the Salesforce and Anypoint Platform organizations. ![Salesforce admin and Anypoint Platform flow for connecting organizations](/mulesoft/current/en-us/access-management/_images/connect-salesforce-anypoint-platform-orgs.png) 1. The Salesforce organization administrator [gets the Salesforce organization tenant key](#get-salesforce-tenant-key). 2. The Salesforce organization administrator shares the tenant key with the Anypoint Platform organization administrator. 3. The Anypoint Platform organization administrator uses the Salesforce organization’s tenant key to [connect with a Salesforce organization in Anypoint Platform](#connect-orgs), and then copies the Anypoint Platform organization key and shares it with the Salesforce organization administrator. 4. The Salesforce organization administrator [completes the connection in Salesforce](#complete-organization-connection) using the Anypoint Platform organization key. ## Get the Salesforce Organization Tenant Key Role: Salesforce organization administrator 1. Log in to your Salesforce organization with your admin credentials. 2. Go to **Setup**. ![Salesforce Setup menu with Setup selected](/mulesoft/current/en-us/access-management/_images/salesforce-setup.png) 3. From **Setup**, in the Quick Find box, enter `MuleSoft`, and then select **MuleSoft > Anypoint Platform Setup**. > [!NOTE] If you don’t see **MuleSoft > Anypoint Platform Setup** in your Salesforce org, > contact MuleSoft Support and provide your Salesforce org ID. Ask Support to turn on the > **Enable Flow API Actions** permission. 4. In **Your connected Anypoint Platform Organization**, click **Complete the Connection**. 5. In **Connection to MuleSoft Anypoint Platform**, copy the Salesforce organization tenant key. 6. If you’re signed in to the Salesforce organization as an administrator, click **Go to Anypoint Platform**. 7. Select the region for your Anypoint Platform organization and click **Go to Anypoint Platform**. 8. Sign in to Anypoint Platform using an account that has the root Organization Administrator permission and continue to [Connect with a Salesforce Organization in Anypoint Platform](#connect-orgs). ## Connect with a Salesforce Organization in Anypoint Platform Role: Anypoint Platform organization administrator Start the process of connecting to a trusted Salesforce organization in Anypoint Platform. You must have the Salesforce organization’s connection key (tenant key) before you can connect to a Salesforce organization. Contact the Salesforce organization administrator to get the tenant key. 1. Sign in to Anypoint Platform using an account that has the root Organization Administrator permission. 2. Select **Access Management** from the ![gear icon](/mulesoft/current/en-us/access-management/_images/gear.svg) menu. 3. Select **Salesforce**. 4. Click **Add Salesforce Org**. 5. Enter the Salesforce organization’s tenant key, and click **Confirm**. The format for the Salesforce tenant key is `cloud/env/org-id`. 6. In **Add the Salesforce Org**, verify the information and click **Add**. Anypoint Platform generates and provides the organization key (or tenant key) in the format `cloud/env/org-id`. 7. Click **Copy** to copy the Anypoint Platform organization key. To complete the connection process, the Salesforce organization administrator enters this organization key (tenant key) into the Salesforce organization you’re connecting to in Salesforce. 8. If you’re the administrator for the Salesforce organization you’re adding, click **Manage in Salesforce** to continue setting up the relationship in Salesforce. If you’re not the Salesforce administrator, provide the Anypoint Platform organization key to the Salesforce administrator so they can finish the connection process in Salesforce. When the connection process is complete, the Salesforce organization appears in the **Salesforce Orgs** section of the **Salesforce** page. ## Complete the Organization Connection in Salesforce Role: Salesforce organization administrator Complete the connection between your organization and the Anypoint Platform organization after the connection process is initiated in Anypoint Platform. You must have the Anypoint Platform organization key (tenant key) to complete the connection. 1. Log in to your Salesforce organization with your admin credentials. 2. Go to **Setup**. ![Salesforce Setup menu with Setup selected](/mulesoft/current/en-us/access-management/_images/salesforce-setup.png) 3. From **Setup**, in the Quick Find box, enter `MuleSoft`, and then select **MuleSoft > Anypoint Platform Setup**. > [!NOTE] If you don’t see **MuleSoft > Anypoint Platform Setup** in your Salesforce org, > contact MuleSoft Support and provide your Salesforce org ID. Ask Support to turn on the > **Enable Flow API Actions** permission. 4. In **Your connected Anypoint Platform Organization**, click **Complete the Connection**. 5. In **Connection to MuleSoft Anypoint Platform**, enter the Anypoint Platform organization key in **Anypoint Platform Organization ID**, and then click **Connect**. The format for the Anypoint Platform organization key is `cloud/env/org-id`. If you don’t have the Anypoint Platform organization key, contact the Anypoint Platform organization administrator. You return to the **Connection to MuleSoft Anypoint Platform** page. The page shows the connected Anypoint Platform organization details, including the enablement status of the capabilities associated with your Salesforce organization. ## See Also - [Salesforce Organization Connections in Anypoint Platform](https://docs.mulesoft.com/access-management/trusted-salesforce-org) - [Managing Connected Salesforce Orgs](https://docs.mulesoft.com/access-management/managing-connected-salesforce-orgs) --- product: Access Management version: master --- # Creating Connected Apps in Anypoint Platform > For the full documentation index, see: https://docs.mulesoft.com/llms.txt Create connected apps to integrate external or internal applications with Anypoint Platform using OAuth 2.0 and OpenID Connect. Configure app type and grant types, define redirect URIs and scopes, and manage credentials for least-privilege access. When you create connected apps, keep in mind: - Your organization can own up to 2000 connected apps at the root organization or business group level. - Each connected app can have up to 1000 scopes. - All scopes in the endpoint correspond directly to permissions available in Anypoint Platform, except for exceptions noted in [Endpoint Scopes](#endpoint-scopes). Scopes determine the level of permissions to provide to the app. - Your Anypoint Platform organization owns your app. Any organization administrator of the root organization or business group in which the app resides can control it. - A unique `clientID` is automatically assigned and can’t be changed. - The `clientSecret` has no expiration date by default but you can change the expiration date. ## Before You Begin - You need the Organization Administrator permission at the business group level you want to create connected apps in and specify access scopes for. For more information, see [Access Management Permissions](https://docs.mulesoft.com/access-management/permissions-by-product#access-management). - Determine whether the app is internal to your company or is a third-party app that’s distributable outside of your organization. ## Create a Connected App That Acts on Behalf of a User 1. In the Access Management navigation menu, click **Connected Apps**. 2. Optionally, select the business group to create the connected app in. 3. Click **Create App** and enter a unique name for the application. 4. For **Type**, select **App acts on behalf of a user**. 5. Select the grant types to use with the app: - Authorization Code - Password - JWT Bearer > [!NOTE] Based on the grant type you select, additional information might be requested. For > more information about grant types, see > [Grant Types and Token Flow](#grant-types-and-token-flow). 6. In **Website URL** , enter the URL where users go to learn more about the app. 7. In **Redirect URIs**, configure which URIs users are directed to after authorization. Type the URL and click **Add** to add it to the list. 8. In **Audience**, select either: - **Members of this organization only** if the app is internal to your organization - **All Anypoint Platform users** if it’s a third-party public app that can be distributed outside of your organization 9. Click **Add Scopes**. Scopes are roles with associated permissions, which determine the actions the app can perform within a business group and environment. For more information, see [Endpoint Scopes](#endpoint-scopes). 10. In **Add Scopes**, select the scopes to apply and click **Add Scopes**. 11. If applicable, select the business groups to apply the scopes to and click **Next**. 12. If applicable, select the environments to apply the scopes to and click **Next**. 13. Click **Add Scopes**, and then click **Save**. ## Create a Connected App That Acts on Its Own Behalf 1. In the Access Management navigation menu, click **Connected Apps**. 2. Optionally, select the business group to create the connected app in. 3. Click **Create App** and enter a unique name for the application. 4. Select **App acts on its own behalf (client credentials)**. 5. Click **Add Scopes**. Scopes are roles with associated permissions, which determine the actions the app can perform within a business group and environment. For more information, see [Endpoint Scopes](#endpoint-scopes). 6. In **Add Scopes**, select the scopes to apply and click **Add Scopes**. 7. If applicable, select the business groups to apply the scopes to and click **Next**. 8. If applicable, select the environments to apply the scopes to and click **Next**. 9. Click **Add Scopes**, and then click **Save**. ## Grant Types and Token Flow The OAuth framework specification describes grant types for getting access tokens for different use cases. Anypoint Platform supports these grant types: - [Authorization Code](#auth-code) - [Refresh Token](#refresh-token) - [Password](#password) - [JWT Bearer Token](#jwt-bearer) - [Client Credentials](#client-credentials) For more information and examples on how to use each grant type, see the [Connected App Examples](https://dev-portal.mulesoft.com/apis/access-management.html) in the Access Management API documentation. ### Authorization Code Use the `authorization_code` grant type to authorize the app to access a user’s data. This is an example of the development flow: 1. A developer creates the connected app that acts on behalf of a user with the `authorization_code` grant type. 2. The end user authorizes the app to act on their behalf. 3. The authorization server sends a temporary authorization code back to the specified redirect URI. 4. The app calls the authorization server with the temporary code to receive the access token. The access token can now be used to call Anypoint Platform APIs on the user’s behalf. ### Refresh Token Use the `refresh_token` grant type to grant access to user data when the user isn’t signed in. Refresh tokens expire after 90 days. Access tokens expire after the user’s session expires. To work with OpenID Connect, apps exchange refresh tokens for new access tokens after the initial authorization to continue accessing user data. If the app is using the authorization code grant type, the `offline_access` scope is required to use refresh tokens after the original access tokens expire. To request a new access token, send a request to the token endpoint using the `refresh_token` grant type. When authentication is successful, a refresh token is exchanged for an access token. ### Password Use the `password` grant type when the application exchanges the user’s username and password for an access token. > [!NOTE] This grant type isn’t recommended, as it reveals user credentials directly to the > connected app. This type also precludes the use of additional security measures, such as > multi-factor authentication. ### JWT Bearer Token Use the `jwt_bearer` (`urn:ietf:params:oauth:grant-type:jwt-bearer`) grant type when the application receives access tokens without transmitting sensitive information, such as the client secret. The `jwt_bearer` grant type is suitable for use with trusted clients to gain access to protected resources without user authorization, for example: 1. A developer creates the connected app that acts on behalf of a user with `jwt_bearer` as the grant type. 2. The JWT token exchange occurs with these claims in the payload:
AttributeDescription

iss

The issuer of the claim. This value must be same as the connected app’s clientId.

sub

The subject of the token, such as:

{version}|{identityProviderId}|{username}|{firstname}|{lastname}|email|externalgroups
At minimum, identityProviderId and username are required for sub, as these subjects identify the user in the system.

aud

The authentication server. For example, the authentication server for the US region is https://anypoint.mulesoft.com/accounts/api/v2/oauth2/token.

3. The app calls the authorization server with the generated assertion. ### Client Credentials Use the `client_credentials` grant type for machine-to-machine authentication when a specific user’s permission to access data isn’t required. The `client_credentials` grant type uses the `clientId` and `clientSecret` of the client to authorize and access protected data. To prevent service disruptions, configure CI/CD pipelines to use service accounts that call Anypoint Platform with connected apps, especially when enabling [multi-factor authentication](https://docs.mulesoft.com/access-management/multi-factor-authentication). ## Endpoint Scopes Most of the scopes in the [discovery endpoint](https://anypoint.mulesoft.com/accounts/api/v2/oauth2/.well-known/openid-configuration) map directly to existing permissions in Anypoint Platform. Other available scopes are: - `full` Full access to anything the user can do. - `read:full` Read-only access to anything the user can read. - `openid` Read-only access to the user’s username and unique Anypoint Platform ID. - `profile` Read-only access to the user’s Anypoint Platform profile. - `email` Read-only access to the user’s email. - `offline_access` Access to the user’s data when they’re not signed in. - `openid:google_wif` `id_token` and an access token used to configure Anypoint Platform as an IdP for Google Cloud during the OAuth2 token flow for `client_credentials` connected apps. This ID token conforms to the IdP requirements as outlined in the [GCP’s WIF requirements](https://docs.cloud.google.com/iam/docs/workload-identity-federation-with-other-providers). > [!NOTE] Apps that use the `client_credentials` grant type always have the `profile` scope assigned > to them implicitly. The data returned by queries uses the scope that corresponds to the user who > created the connected app. ### Access Scopes Documentation For more information about scopes and permissions in the Connected Apps feature, see the scopes documentation page in Access Management: 1. In the Access Management navigation menu, click **Connected Apps**. 2. In **Connected Apps**, click the **Scopes Documentation** tab. **Scopes Documentation** shows the scopes, their respective permissions, and the products they belong to. 3. Use the search bar and filters to locate a scope based on the name, display name, permission methods, supported app type, or product label. 4. In the list of scopes, click a scope name to view the associated permissions and learn more about the scope. You can filter and sort the contents of the **Scopes Documentation** page, and you can also click a scope name to view namespaces, methods, and actions. ## Sign In with the Anypoint Platform Widget For seamless implementation, you can integrate a button into the front end of your apps with a prebuilt template and set of components. To add this widget, use this code: For more information about how to embed the button, see the [developer playground](https://anypoint-web-components.github.io/anypoint-signin/). ## See Also - [Access Management API - Connected App Examples](https://dev-portal.mulesoft.com/apis/access-management.html) - [Anypoint Platform Connected Apps for Developers](https://docs.mulesoft.com/access-management/connected-apps-developers) - [Anypoint Platform Connected Apps for Organization Administrators](https://docs.mulesoft.com/access-management/connected-apps-org-admin) --- product: Access Management version: master --- # Enable External Access to a Trusted Anypoint Platform Organization > For the full documentation index, see: https://docs.mulesoft.com/llms.txt To establish a connection to a trusted Anypoint Platform organization, both organizations must reside in the same control plane, and trust must be established between organizations before permissions can be granted. For the users of Organization A to share with the users of Organization B, Organization A must list Organization B as a trusted organization, and Organization B must likewise list Organization A. If either Organization A or Organization B removes the other, all shared permissions are revoked. Permissions shared between organizations are granted at the organization level. For example, if Organization A grants Organization B permission to view an asset, it grants that permission to every user in Organization B. Organization A does not receive any information about Organization B’s users, sub-organizations, or internal layout. ## Add a New Trusted Organization When you add a new organization to your external access configuration, you establish one half of a trust relationship. After the other organization adds yours to its configuration, both organizations can share permissions with each other. To add an organization to your configuration, you must know its Anypoint Platform domain. Domains are human-readable names that uniquely identify an Anypoint Platform organization. Ask the administrators of the other organization what their domain is, and be prepared to share your domain with them so they can add your organization to their list in return. You can view your organization’s unique domain name in the **External Access** page in Access Management. To add an external organization to your list of trusted organizations: 1. From the **Access Management** home page, click the **External Access** tab. 2. In the **External Access** page, click **Add organization**. 3. Enter the unique domain name of the organization you want to share permissions with. 4. Click **Add**. ## Remove a Trusted Organization When you remove a trusted organization from your external access configuration, both organizations lose all existing shared permissions. In addition, you cannot grant new permissions until you reestablish the trust relationship. To remove a trusted organization: 1. From the **Access Management** home page, click the **External Access** tab. 2. In the **External Access** page, select **…** next to the name of the organization you want to remove. 3. Click **Remove organization**. 4. Click **Yes, remove**. --- product: Access Management version: master --- # Enable or Disable Capabilities for a Connected Salesforce Organization > For the full documentation index, see: https://docs.mulesoft.com/llms.txt After connecting your Anypoint Platform organization to a trusted Salesforce organization, you can enable or disable capabilities associated with that connection. Enabling a capability activates the corresponding integration feature for your organization. - [Enabling or Disabling Generative AI for Anypoint Platform](https://docs.mulesoft.com/access-management/enabling-generative-ai) - [Enabling API Catalog for Salesforce](https://docs.mulesoft.com/access-management/enabling-api-catalog) - [Enabling Integration Intelligence for Anypoint Platform](https://docs.mulesoft.com/access-management/enabling-integration-intelligence) - [Enabling MuleSoft Direct in Anypoint Platform](https://docs.mulesoft.com/access-management/enabling-mulesoft-direct) ## See Also - [Salesforce Organization Connections in Anypoint Platform](https://docs.mulesoft.com/access-management/trusted-salesforce-org) - [Managing Connected Salesforce Orgs](https://docs.mulesoft.com/access-management/managing-connected-salesforce-orgs) --- product: Access Management version: master --- # Enabling and Managing Multi-Factor Authentication in Anypoint Platform > For the full documentation index, see: https://docs.mulesoft.com/llms.txt Anypoint Platform multi-factor authentication (MFA) adds a second verification step when users log in with their Anypoint Platform credentials or via single sign-on (SSO). MuleSoft requires MFA for all users. You can also register authenticator apps, security keys, or built-in device authentication. Organization administrators configure exempt service accounts and reset MFA for individual users when needed. MFA is enabled by default for direct signins and can’t be turned off at the organization level. However, a few service account types don’t require MFA. An organization administrator can waive MFA for these accounts so that existing integrations can continue without interruption. > [!NOTE] For SSO users, set up MFA through the identity provider (IdP). Because MFA is managed by > the IdP, multi-factor authentication is shown as `n/a` in user Settings for SSO users. When a user signs in with their Anypoint Platform credentials, they must enter their password and then verify their identity with one of these verification methods: - Third-party TOTP authenticator apps - Built-in authenticator - Security key - Salesforce Authenticator ## Multi-Factor Authentication Requirements for Salesforce and MuleSoft Products - Effective February 1, 2022, MFA must be enabled for all of your Anypoint Platform users. To learn more about this contractual requirement, see the [Salesforce Multi-Factor Authentication FAQ](https://help.salesforce.com/s/articleView?id=000396727&type=1). - As of October 29, 2022, all non-SSO accounts that don’t have MFA configured are prompted to register for an MFA verification method and use it to log in to Anypoint Platform. ## Multi-Factor Authentication Verification Methods You can configure at least one of these verification methods to comply with multi-factor authentication requirements: Third-party TOTP authenticator app Registers an authenticator app to create verification codes that you provide when you log in to Anypoint Platform. Built-in authenticator Registers a physical authentication device, such as Touch ID or Windows Hello, to verify your identity when you log in to Anypoint Platform. Security key Registers a security key, such as Yubico YubiKey or Google Titan Security Key, to your account. Connect the security key to your computer to verify your identity when you log in to Anypoint Platform. Salesforce Authenticator Registers the Salesforce Authenticator mobile app to send you push notifications verifying your identity when you log in to Anypoint Platform. ## Exclude Exempt Accounts from Multi-Factor Authentication These types of service accounts are exempt from the requirement to use MFA: - Test automation tools, such as Selenium, Cucumber, or Appium - Robotic Process Automation (RPA) systems, such as Automation Anywhere > [!IMPORTANT] MuleSoft requires customers to use > [internal connected apps](https://docs.mulesoft.com/access-management/connected-apps-org-admin) instead of service accounts that make > programmatic calls to Anypoint Platform. Connected apps provide more security and control than > service accounts. If you’re having trouble switching to connected apps, reach out to MuleSoft for > help. In the meantime, you can temporarily waive MFA for your existing service accounts until > they’re transitioned to connected apps. To prevent service disruptions, waive MFA for valid MFA-exempt accounts in your organization. After August 1, 2023, waiving MFA for user accounts isn’t permitted. 1. Sign in to Anypoint Platform using an account that has the Organization Administrator permission. 2. Select **Access Management** from the ![gear icon](/mulesoft/current/en-us/access-management/_images/gear.svg) menu. 3. In the **Business Groups** menu, select your root organization. 4. In the Access Management navigation menu, click **Identity Providers**. 5. Select your Anypoint Platform identity provider. 6. In the **Exempt Accounts** section, add the accounts that are valid to exclude from MFA. Only accounts that don’t use single sign-on (SSO) appear in this list. 7. Click **Save**. The exempt accounts appear in the **Exempt Accounts** section. You can later remove user accounts from the **Exempt Accounts** list by clicking **X** next to their account names. ## Manage Multi-Factor Authentication for Your Account You can modify the verification methods that you use to log in. Register at least one method to use MFA. To modify verification methods in your account: 1. Sign in to Anypoint Platform. 2. In the Anypoint Platform navigation bar, click the circle icon with the initials associated with your Anypoint Platform account and select your name. 3. Select **Configure multi-factor authentication (MFA)**. 4. To register an additional verification method: 1. Next to the verification method to configure, click **Add**. 2. Follow the instructions to configure your preferred verification method. 3. Click **Done**. 5. To modify the name of an existing verification method: 1. Select the pencil icon next to the verification method to rename. 2. Enter a new name for your verification method. 3. Select the checkmark. 4. Click **Done**. 6. To remove a verification method: 1. Next to the verification method to remove, select the bin icon. 2. Click **Yes**. 3. Click **Done**. > [!NOTE] If you removed all verification methods, you must configure at least one > verification method before you save your changes. 7. Click **Save**. ## Reset Multi-Factor Authentication for Individual Users You can reset multi-factor authentication for individual users if a device is compromised or lost. If you’re the only organization member with Organization Administrator permission and have lost access to your verification methods, contact customer support. To reset multi-factor authentication for an individual user: 1. Sign in to Anypoint Platform using an account that has the Organization Administrator permission. 2. Select **Access Management** from the ![gear icon](/mulesoft/current/en-us/access-management/_images/gear.svg) menu. 3. In the **Business Groups** menu, select your root organization. 4. In the Access Management navigation menu, click **Users**. 5. Select the user to reset multi-factor authentication for. 6. From the actions menu (**…​**), select **Reset multi-factor authentication**. 7. Click **Confirm reset MFA**. Next time the user signs in to Anypoint Platform, they’re prompted to configure a new verification method. ## See Also - [Managing Security Settings](https://docs.mulesoft.com/access-management/managing-security-settings) - [Managing your Anypoint Platform Account](https://docs.mulesoft.com/access-management/managing-your-account) --- product: Access Management version: master --- # Enabling API Catalog for Salesforce > For the full documentation index, see: https://docs.mulesoft.com/llms.txt Enable a connected Salesforce organization to access and sync Anypoint Platform APIs into API Catalog in Salesforce. Organization administrators configure this in Anypoint Platform Access Management. ## Enable or Disable API Catalog for Salesforce in Anypoint Platform 1. Sign in to Anypoint Platform using an account that has the Organization Administrator permission. 2. Select **Access Management** from the ![gear icon](/mulesoft/current/en-us/access-management/_images/gear.svg) menu. 3. Select **Salesforce**. 4. In the section for your connected Salesforce org, switch to **Enabled** for **You allow this Salesforce org to import APIs**. 5. In **Settings for Anypoint APIs in Salesforce**, select **Continue**. 6. In **Settings**, select the Anypoint Platform business groups that allow the Salesforce organization to import Anypoint Platform APIs into its API Catalog, and select **Save settings**. > [!NOTE] Within the selected business groups, you can sync only APIs from Exchange that have > managed instances and meet the prerequisite conditions. For more information, see > [API Catalog](https://help.salesforce.com/s/articleView?id=platform.api_catalog.htm). ![Connected Salesforce organization with both Invocable Actions and API Catalog enabled](/mulesoft/current/en-us/access-management/_images/connected-salesforce-org-api-catalog-enabled.png) The Salesforce organization administrator can then sync APIs into their catalog. 7. After the APIs are synced, the Salesforce administrator selects individual API instances and operations and converts them into invocable actions so Salesforce developers can access them. A client ID is created. 8. An access request for the Salesforce developers selected by the Salesforce administrator is sent to the Anypoint Platform owner of that API through API Manager. After the request is accepted, Salesforce developers can start using the API. ## See Also [Connecting a Trusted Salesforce Organization to Anypoint Platform](https://docs.mulesoft.com/access-management/connecting-salesforce-orgs) --- product: Access Management version: master --- # Enabling Integration Intelligence for Anypoint Platform > For the full documentation index, see: https://docs.mulesoft.com/llms.txt Integration Intelligence uses AI to enhance monitoring, analysis, and troubleshooting of MuleSoft integrations. Anypoint Platform organization administrators enable this feature to unlock AI-powered insights across integration environments. For more information, see [Integration Intelligence](https://docs.mulesoft.com/monitoring/integration-intelligence). > [!NOTE] As of October 14, 2025, Data Cloud has been rebranded to Data 360. During this transition, > you may see references to Data Cloud in our application and documentation. While the name is new, > the functionality and content remain unchanged. ## Before You Begin Before enabling Integration Intelligence in your Anypoint Platform organization, you must have: - An Anypoint Platform Integration Advanced or legacy Titanium package. - Salesforce Enterprise, Performance, or Unlimited edition. - A Tableau Next license. - Administrative access to an Anypoint Platform organization that isn’t a trial organization and isn’t expired. - Administrative access to a Salesforce organization. - [A tenant relationship](https://docs.mulesoft.com/access-management/trusted-salesforce-org) between your Anypoint Platform organization and a trusted Salesforce organization established. > [!NOTE] The connected Salesforce organization must have Data 360 and Tableau Next enabled. For > more information, see > [Tableau Next Setup Guide](https://help.tableau.com/current/online/en-us/tableau_next_setup_guide.htm). - Einstein generative AI enabled in the connected Salesforce organization and your Anypoint Platform organization. For more information, see [Enabling or Disabling Generative AI for Anypoint Platform](https://docs.mulesoft.com/access-management/enabling-generative-ai). - To avoid installation failures while testing through your Salesforce sandbox organization, make sure that your Single source of truth (SSOT) package version is v1.120 or later. For more information, see [Verify the SSOT Package Version in Data Cloud](https://help.salesforce.com/s/articleView?id=ind.cg_tpm_data_cloud_verify_ssot.htm&type=5). ## Integration Intelligence High-Level Flow After the Anypoint Platform organization administrator establishes a connection between the Anypoint Platform organization and the Salesforce organization, the Salesforce admin sets up Integration Intelligence in the Salesforce organization. This diagram shows the high-level flow for the Salesforce and Anypoint Platform organization administrators to set up Integration Intelligence in the Salesforce org. ![Salesforce admin flow for setting up Integration Intelligence](/mulesoft/current/en-us/access-management/_images/ii-salesforce-admin-flow.png) 1. Log in to your Salesforce organization. 2. In Salesforce Setup, enter `MuleSoft` in the **Quick Find** box, then select **MuleSoft > Integration Intelligence**. 3. On the **Integration Intelligence Setup Assistant** page, follow the setup steps in order: 1. [Set up Data 360](#set-up-data-cloud). 2. [Connect with Anypoint Platform](#connect-with-anypoint-platform). 3. [Enable Telemetry Data](#enable-telemetry-data). 4. The Anypoint Platform organization administrator now completes the setup steps to enable Integration Intelligence in Anypoint Platform. 5. After the Anypoint Platform organization administrator completes the setup steps in Anypoint Platform, the Salesforce admin completes the rest of the Integration Intelligence setup in the Salesforce org. 1. [Enable Seamless Login](#enable-seamless-login) for Anypoint Platform users to access Tableau Next dashboards in Salesforce. 2. [Install Integration Intelligence](#install-integration-intelligence). ## Set up Data 360 Connect your Salesforce organization to Data 360. Data 360 is the storage and processing layer for Integration Intelligence. It ingests MuleSoft telemetry data from your selected business group into a Data 360 data space. 1. In the **Data Cloud** section, click **Setup**. For information about setting up Data 360, see [Get Started with Data 360](https://help.salesforce.com/s/articleView?id=data.c360_a_product_considerations.htm&type=5). ## Complete the Connection with Anypoint Platform Complete the connection between your Salesforce organization and Anypoint Platform so Salesforce can ingest MuleSoft telemetry data from your selected business group into Data 360. 1. From **Setup**, in the Quick Find box, enter `MuleSoft`, and then select **MuleSoft > Anypoint Platform Setup**. 2. On the **MuleSoft Anypoint Platform Setup** page, click **Complete the Connection**. 3. Copy your Salesforce org tenant key. The format for the Salesforce tenant key is `cloud/env/org-id`. 4. Sign in to Anypoint Platform using an account that has the root Organization Administrator permission. 5. Select **Access Management** from the image::access-management::gear.svg\["gear icon",20\] menu. 6. Select **Salesforce**. 7. Click **Add Salesforce Org**. 8. In **Add the Salesforce Org**, paste the Salesforce org tenant key, and click **Add**. 9. Enter the name of the Salesforce org in **Name Used in Anypoint Platform**, and click **Add**. Anypoint Platform generates and provides the organization key (or tenant key) in the format `cloud/env/org-id`. 10. Click **Copy** to copy the Anypoint Platform organization key. 11. Return to the **MuleSoft Anypoint Platform Setup** page in the Salesforce organization. 12. Enter the Anypoint Platform organization key in **Anypoint Platform Organization ID**, and then click **Connect**. You return to the **MuleSoft Anypoint Platform Setup** page. The page shows the connected Anypoint Platform organization details. ## Enable Telemetry Data Enable telemetry data to stream logs and metrics from your Mule apps and APIs into the selected Data 360 data space. 1. In Salesforce Setup, in the **Quick Find** box, enter `MuleSoft`, then select **MuleSoft Observability**. 2. In **MuleSoft Observability**, switch **Telemetry Data Ingestion for Integration Intelligence** to **Active**. 3. Return to Anypoint Platform **Access Management > Salesforce**. 4. In **Capability enablement** for the connected Salesforce organization, switch **You can’t bring telemetry data into Salesforce Data Cloud** to **Enabled**. 5. In **Enable Telemetry Data Ingestion**, select the business group that contains the apps that will send telemetry data to Data 360, and then click **Next**. > [!NOTE] The business group you select for data ingestion can’t be changed after you save the > settings. 6. In **Select Applications**, select the environment. A list of applications in the selected environment appears. > [!NOTE] The application selection list includes specific versions of Mule on CloudHub 2.0 and > Runtime Fabric. The list of selectable apps isn’t inclusive of all the apps in the selected > business groups. For other deployments (CloudHub, Mule Gateway, Omni Gateway), or some earlier > versions of Mule, telemetry data ingestion is automatically enabled and excluded from the > selection list. 7. Select the applications to ingest telemetry data for, and click **Enable Data Ingestion**. You can search for applications by name and you can also select **Show only applications available for selection** to filter the list and show only applications that use the latest runtime versions. The settings are saved. Any subsequent changes made to Integration Intelligence in Access Management are automatically shared with the connected Salesforce organization. For example, turning off the Integration Intelligence feature in Anypoint Platform disables: - Trust with the connected Salesforce organization. Turning it back on restores trust and enables data ingestion for the selected business group. - Seamless login for Anypoint Platform users to access Tableau Next dashboards in Salesforce. Turning it back on restores seamless login. ## Enable Seamless Login for Anypoint Platform Users The Salesforce admin enables seamless login for Anypoint Platform users to access Tableau Next dashboards in Salesforce without needing to create new credentials or perform additional login steps. 1. If you aren’t logged in, log in to Salesforce. 2. In Salesforce Setup, enter `MuleSoft` in the **Quick Find** box, then select **MuleSoft > Anypoint Platform Setup**. 3. Switch the **Enable Seamless Login from Anypoint Platform** option to **Enabled**. > [!NOTE] This option is available after the Anypoint Platform organization administrator > completes all their setup steps in Anypoint Platform. If you don’t see the option, contact > your Anypoint Platform organization administrator. ## Install Integration Intelligence The Salesforce admin installs Integration Intelligence in the Salesforce org. > [!NOTE] This step is available only after the Anypoint organization administrator completes all > the Anypoint Platform setup steps. 1. In Salesforce Setup, enter `MuleSoft` in the **Quick Find** box, then select **MuleSoft > Integration Intelligence Setup Assistant**. 2. In **Install Integration Intelligence**, click **Setup**. The setup steps appear. If a step isn’t complete, click **Setup** to complete it. All the steps must be completed before you can install Integration Intelligence. 3. Select **Setup** for **Install Integration Intelligence**. 4. In **Data Space**, select the data space to use for Integration Intelligence. This is the data space where your observability data will be stored and processed and must match the data space where telemetry data is ingested. 5. Click **Next**. 6. In **App Details**, enter a name and description for the Integration Intelligence app, and then click **OK**. After the Integration Intelligence app is successfully installed, you see a **Success** status and the name of the app is shown on a tab in the **Integration Intelligence Setup** page. ## See Also [Integration Intelligence](https://docs.mulesoft.com/monitoring/integration-intelligence) --- product: Access Management version: master --- # Enabling MuleSoft Direct in Anypoint Platform > For the full documentation index, see: https://docs.mulesoft.com/llms.txt Enable MuleSoft Direct in Anypoint Platform so Salesforce administrators can discover and deploy pre-built integrations directly from the connected Salesforce organization. Organization administrators configure this after establishing a tenant relationship between Anypoint Platform and Salesforce. An integration is a prebuilt app or a configurable example that simplifies business workflow implementation by allowing external systems to integrate with Salesforce Cloud apps. An integration can depend on several other apps required to complete a business use case. ## Before You Begin Before enabling MuleSoft Direct in your Anypoint Platform organization, you must: - Have the root Organization Administrator permission and role. - Have administrative access to the connected Salesforce organization. - [Establish a tenant relationship](https://docs.mulesoft.com/access-management/connecting-salesforce-orgs) between your Anypoint Platform organization and a trusted Salesforce organization. ## Enable MuleSoft Direct in Anypoint Platform After you establish a tenant relationship between your Anypoint Platform organization and a trusted Salesforce organization, the Anypoint Platform organization administrator enables MuleSoft Direct in Anypoint Platform. 1. Sign in to Anypoint Platform using an account that has the Organization Administrator permission. 2. Select **Access Management** from the ![gear icon](/mulesoft/current/en-us/access-management/_images/gear.svg) menu. 3. Select **Salesforce**. 4. In the section for the connected Salesforce organization to enable MuleSoft Direct for, select **Enable**. 5. Select **Continue**. 6. Select the business groups to enable MuleSoft Direct integrations for, and then select **Save settings**. ## Access MuleSoft Direct in Salesforce Setup After MuleSoft Direct is enabled in Anypoint Platform, the Salesforce organization administrator can view and deploy available integration assets to the Salesforce organization. 1. The Salesforce organization administrator navigates to **Setup > MuleSoft > MuleSoft Direct**. 2. Select **Get Started**. 3. Accept the terms and conditions, and select **Save**. ### Deploy Integration Assets When you deploy an integration asset, an application instance is created and shown in **App instances** for the integration asset. For information about enabling and deploying assets from the Salesforce org, see [Enabling Integrations](https://help.salesforce.com/s/articleView?id=ind.enable_integration_assets.htm&type=5). ## Delete an App Instance Remove an app instance that you no longer need from your Salesforce org and Anypoint Runtime Manager. 1. Navigate to **Setup > MuleSoft > MuleSoft Direct**. 2. Select the integration asset to delete. 3. In **App instances**, select the app instance to delete. 4. Select the down arrow, and then select **Delete Instance**. 5. Select **Delete**. ## See Also - [Connecting a Trusted Salesforce Organization to Anypoint Platform](https://docs.mulesoft.com/access-management/connecting-salesforce-orgs) - [Delete an Integration Instance](https://help.salesforce.com/s/articleView?id=ind.industry_integration_delete_integration.htm&type=5) --- product: Access Management version: master --- # Enabling or Disabling Generative AI for Anypoint Platform > For the full documentation index, see: https://docs.mulesoft.com/llms.txt Connect a trusted Salesforce organization and enable generative AI for your Anypoint Platform organization. After it’s enabled, supported MuleSoft products can use it, and tracking and billing route through Salesforce. As an organization administrator, you can assign permission to the users in your organization so they can use generative AI with Anypoint Platform products that support it, including: - Anypoint Code Builder - Anypoint Exchange - Intelligent Document Processing (IDP) ## Before You Begin Einstein Generative AI must be enabled in the connected Salesforce organization before you can enable generative AI in Anypoint Platform. Complete this checklist: 1. Have administrative access to a non-trial, non-expired Anypoint Platform organization, with the root Organization Administrator role. 2. Have administrative access to a Salesforce organization that [has Einstein Generative AI enabled](https://help.salesforce.com/s/articleView?id=ai.generative_ai_enable.htm&type=5). 3. [Establish a tenant relationship](https://docs.mulesoft.com/access-management/trusted-salesforce-org) between your Anypoint Platform organization and that trusted Salesforce organization. 4. Enable generative AI in Anypoint Platform: accept the terms and conditions and set a default Salesforce organization. See [Enable Generative AI for Your Anypoint Platform Organization](#enable-einstein-anypoint). To make the setting that enables generative AI available in Anypoint Platform, complete items 2 and 3, then [enable generative AI in the Salesforce organization](#enable-einstein-salesforce). To use AI-assisted features such as MuleSoft Vibes, users also need the **Mule Developer Generative AI User** permission in Anypoint Platform. Organization administrators receive this permission automatically. To grant it to other users, see [Add the Required Permissions for Users](#add-the-required-permissions-for-users). ## Enable Generative AI for Anypoint Platform in the Salesforce Organization When the Salesforce administrator enables generative AI for the connected Anypoint Platform organization, the connected Salesforce organization routes the requests. The connected Salesforce organization handles tracking and billing. 1. Log in to your Salesforce organization. 2. In Salesforce Setup, enter `MuleSoft` in the **Quick Find** box, then select **MuleSoft > Anypoint Platform Setup**. 3. In **Your connected Anypoint Platform Organization**, select **Complete Connection**. 4. In **Connection to MuleSoft Anypoint Platform**, switch the setting that enables generative AI for Anypoint Platform to **Enabled**. 5. Click **Close**. After you enable it in the Salesforce organization, you see **Enabled in Salesforce** in Anypoint Platform for the connected Salesforce organization. ## Enable Generative AI for Your Anypoint Platform Organization When generative AI is enabled in Anypoint Platform through a connected Salesforce organization, every supported feature in that organization can use it. 1. Sign in to Anypoint Platform using an account that has the Organization Administrator permission. 2. Select **Access Management** from the ![gear icon](/mulesoft/current/en-us/access-management/_images/gear.svg) menu. 3. Select **Salesforce**. 4. When prompted to enable generative AI for Anypoint Platform, select **Accept**. 5. Accept the terms and conditions. The **Salesforce Orgs** section shows the orgs with [established tenant relationships](https://docs.mulesoft.com/access-management/connecting-salesforce-orgs) with your Anypoint Platform organization. Each Salesforce organization shows the enabled and disabled Anypoint Platform capabilities. 6. Select the Salesforce organization to use by default in your Anypoint Platform organization: 1. In **Capabilities managed in Salesforce**, select **Settings** for the capability that enhances the Anypoint Platform developer experience. 2. Select the Salesforce organization, then select **Save**. ## Add the Required Permissions for Users When generative AI is enabled for your Anypoint Platform organization, organization administrators are granted the required permission automatically. To grant other users access, assign the required permissions manually. 1. Sign in to Anypoint Platform using an account that has the Organization Administrator permission. 2. Select **Access Management** from the ![gear icon](/mulesoft/current/en-us/access-management/_images/gear.svg) menu. 3. [Create a team](https://docs.mulesoft.com/access-management/configure-teams) for the users who need access to generative AI. 4. Select the **Permissions** tab. 5. In **Permissions**, select **Add permissions**. 6. Select the **Anypoint Code Builder > Mule Developer Generative AI User** permission and select **Next**. 7. Select the business groups to apply the permissions to. Select which environments to apply the permission to if it’s enabled for the permission. 8. Select **Next**. 9. Review the permissions and the business groups and environments they apply to, and then select **Add Permissions**. ## Disable Generative AI When you disable generative AI for your Anypoint Platform organization, none of the users in your organization can use it in any of the features where it’s enabled. 1. Sign in to Anypoint Platform using an account that has the Organization Administrator permission. 2. Select **Access Management** from the ![gear icon](/mulesoft/current/en-us/access-management/_images/gear.svg) menu. 3. Select **Salesforce**. 4. In the **Capabilities managed in Salesforce** section, switch the capability that enhances the Anypoint Platform developer experience to **Disabled**. ## See Also - [Developing Integrations Using MuleSoft Vibes](https://docs.mulesoft.com/anypoint-code-builder/int-ai-developing-integrations) --- product: Access Management version: master --- # Example Teams Structure > For the full documentation index, see: https://docs.mulesoft.com/llms.txt Imagine that your organization, Acme, includes a team called Engineering that contains smaller teams that focus on building specific components. The Identity and DevOps teams are specialized teams within the larger Engineering team. Using the Teams feature, you can structure your users and permissions in the following way: ![A diagram of a permission structure using the Teams feature](/mulesoft/current/en-us/access-management/_images/access-management-teams-hierarchy.png) The user teams shown in the diagram are: - Acme This team represents your organization and is the root team. Every user in your organization is a member of the root team. By default, the team’s name is Everyone at Acme. You can set your permissions so that all Acme users can easily collaborate within your organization by creating new projects in Anypoint Design Center and viewing assets in Anypoint Exchange. To do this, you must configure the following permissions for the Everyone at Acme team: - Design Center Developer - Exchange Viewer - Engineering This is the first child team of the Everyone at Acme root team. The Engineering team includes all of Acme’s engineers, but it excludes Acme’s other members, such as the Marketing and Partner teams. The Engineering team inherits permissions from the Everyone at Acme team, and you can give it additional permissions as needed. You can set permissions that allow the members of the Engineering team to deploy code to preproduction environments such as sandbox and design, but you can exclude permissions to deploy to production. To do this, you must configure the following permissions for the Engineering team: - Deploy API Proxies (applicable to sandbox and design environments) - Design Center Developer - Exchange Viewer - DevOps This team is one of two child teams under the Engineering team. The DevOps team is a group of specialized engineers who manage production code across all engineering teams. Unlike with the parent Engineering team, you can give the DevOps team permission to manage code in the production environment, rather than only in the preproduction branches. To do this, you must configure the following permissions for the DevOps team: - Deploy API Proxies (applicable to sandbox, design, and production environments) - Design Center Developer - Exchange Viewer - Identity This team is one of two child teams under the Engineering team. The Identity team is responsible for managing projects, assets, and other materials in its designated business groups. As a child of the Engineering team, the Identity team can still deploy code to preproduction environments, but unlike members of DevOps, members of Identity don’t need to deploy to production. You can’t give this team permission to manage the entire organization, but you can give it permission to manage the Audit Log and Authentication service business groups by configuring the Administrator permission within the scope of the Audit Log and Authorization Service business groups. Combined with the inherited permissions from the Engineering team, the Identity team has these permissions: - Administrator (applicable to Audit Log and Authorization Service business groups) - Deploy API Proxies (applicable to sandbox and design environments) - Design Center Developer - Exchange Viewer ## See Also - [Available Permissions by Product](https://docs.mulesoft.com/access-management/permissions-by-product) - [Grant Permissions to Individual Users](https://docs.mulesoft.com/access-management/users#grant-user-permissions) - [Teams](https://docs.mulesoft.com/access-management/teams) --- product: Access Management version: master --- # Getting the Bearer Token for a Connected App in Anypoint Platform > For the full documentation index, see: https://docs.mulesoft.com/llms.txt Use this example as a reference for creating a connected app with client credentials, adding Runtime Manager scopes, and retrieving a bearer token to invoke Anypoint Platform APIs. The example includes deploying the app to CloudHub and using the Access Management API to obtain the token. ## Create a Connected App To create a connected app, add Runtime Manager scopes, and deploy the app to CloudHub: 1. In the Access Management navigation menu, click **Connected Apps**. 2. In **Owned Apps**, click **Create App**. 3. In **Create App**, enter a unique name for the app, select **App acts on its own behalf (client credentials)**, and then click **Save**. 4. Click **Add Scopes**. 5. Select the scopes for the app from the **Runtime Manager** section, and then click **Next**. For information about scopes and permissions for connected apps, see the [Endpoint Scopes](https://docs.mulesoft.com/access-management/connected-apps-developers#endpoint-scopes). 6. Select the **Business Groups** the app has permission to access the assigned scopes in and click **Next**. 7. Select the **Environments** for the business groups and scopes you selected, and click **Next**. 8. Review the scopes you added and click **Add Scopes**. ![Add scopes review with Runtime Manager scopes selected](/mulesoft/current/en-us/access-management/_images/bearer-token-example-review-scopes.png) 9. In **Update App**, click **Save Changes**. ## Get the bearer token To get the bearer token for the app: 1. In the Access Management navigation menu, click **Connected Apps**. 2. In **Owned Apps**, click **Copy Id** and save the app’s client ID in a secure location. 3. Repeat the previous step to copy the app’s client secret. 4. Run the following cURL command and replace `CLIENT_ID` and `CLIENT_SECRET` with your client ID and secret: ```command curl --location --request POST https://anypoint.mulesoft.com/accounts/api/v2/oauth2/token \ --header 'Content-Type: application/x-www-form-urlencoded' \ --data-urlencode 'client_id=' \ --data-urlencode 'client_secret=' \ --data-urlencode 'grant_type=client_credentials' ``` You receive the following response: { "access\_token": "", "token\_type": "bearer" } Now that you have the bearer token, you can use the connected app to invoke Anypoint Platform APIs. For more examples, see the [Access Management API documentation](https://dev-portal.mulesoft.com/apis/access-management.html). ## See Also - [Anypoint Platform Connected Apps for Developers](https://docs.mulesoft.com/access-management/connected-apps-developers) --- product: Access Management version: master --- # LDAP Configuration > For the full documentation index, see: https://docs.mulesoft.com/llms.txt - [To Map Users to Teams or Roles in an LDAP Group](https://docs.mulesoft.com/access-management/map-users-roles-teams#configure-multiple-group-mappings-for-single-sign-on-using-ldap) - [To Configure LDAP in Anypoint Platform Private Cloud](https://docs.mulesoft.com/access-management/conf-ldap-private-cloud-task) --- product: Access Management version: master --- # Managing Business Groups in Anypoint Platform > For the full documentation index, see: https://docs.mulesoft.com/llms.txt Use business groups to delegate administrative responsibilities, control access to resources, and structure your organization’s access management. In the Access Management **Business Groups** page, you can: - Create business groups. - View a hierarchical tree of all the business groups you have permissions to view. - View and edit properties of a business group. Permissions determine What you can view and edit. - Add and delete business groups (if enabled at the root business group level). - View the Client ID and Client Secret for environments. ## Access a Business Group 1. Sign in to Anypoint Platform using an account that has the Organization Administrator permission. 2. Select **Access Management** from the ![gear icon](/mulesoft/current/en-us/access-management/_images/gear.svg) menu. 3. In the Access Management navigation menu, click **Business Groups**. 4. Click the name of the root business group. ## Create a Business Group When you create a new business group under the top-level (root) business group, all the current users with the Organization Administrator permission in the root business group appear in the list of users in the newly created business group. 1. Sign in to Anypoint Platform using an account that has the Organization Administrator permission. 2. Select **Access Management** from the ![gear icon](/mulesoft/current/en-us/access-management/_images/gear.svg) menu. 3. In the Access Management navigation menu, select **Business Groups**. 4. Click the name of the business group. The **Settings** section appears, showing details about the root organization or business group. 5. To create the root business group for your organization, click **Create business group**. 6. To create a child business group, click the **…​** menu for the parent business group. 7. Click **Create child group**. 8. In the dialog box, enter: - **Business Group name**: Name for the new business group. - **Owner**: Assign an existing Organization Administrator as the business group owner. - Select **Can create Business Groups** to allow the owner to create child business groups under this business group. - Select **Can create environments** to allow the owner to create environments within this business group. - You can assign some or all of the redistributable resources (vCores, VPCs, and so on) that your organization owns to an individual business group. This ensures that the resources are used by the CloudHub deployments that belong to the business group. You can assign the resources when you create the business group, or edit these settings later. - **Enable CloudHub global deployment** This option is available only if global deployment is enabled on the parent business group. When global deployment is enabled, the region is auto-populated according to the region you specified. - **Static IPs** This option is available only if the parent business group has static IPs assigned to it. This option enables the use of static IP addresses. 9. Click **Add Business Group**. The business group appears in the hierarchy, under the root organization. > [!NOTE] Allocating redistributable resources to a business group makes those resources available > only to that business group, which makes them unavailable to the parent organization. ## Create a Child Business Group Create a business group hierarchy to help you better control user access to resources. 1. To create a child business group, click the **…​** menu for the parent business group. 2. In the **Add Business Group** dialog, enter a **Business Group name** and **Owner**, then select from these options: - **Owner can create Business Groups** Users with the Organization Administrator permission can create child business groups in a business group that they own. - **Owner can create environments** Users with the Organization Administrator permission can create environments within their business groups. - **Enable CloudHub global deployment** This option is available only if global deployment is enabled on the parent business group. When global deployment is enabled, the region is auto-populated according to the region you specified. - **Static IPs**: This option is available only if the parent business group has static IPs assigned to it. This option enables the use of static IP addresses. 3. Click **Add Business Group**. The new business group appears in the parent business group hierarchy. ## Navigate Between Business Groups When your organization has multiple business groups, you can switch between them in the list of business groups. Switching between business groups changes the list of available CloudHub deployments, APIs, users, and roles settings. ![A business group and a list of its sub-groups](/mulesoft/current/en-us/access-management/_images/switch-suborg.png) > [!NOTE] When you create a business group, log out and log in to Anypoint Platform to see > newly-created business groups in the business group navigation menu. When you log in to Anypoint > Platform, you return to the business group where you were last active when you logged out of > Anypoint Platform. If you don’t have the Organization Administrator permission, you can view only the business groups that you have permissions to view. In the **Organization** tab, your organization tree displays only the business groups to which you belong. ### View User and Team Access You can view a list of users or teams that have access to a business group or environment and filter by their assigned permissions. 1. In the Access Management navigation menu, select **Business Groups**. 2. Click the name of the business group. The **Settings** section appears, showing details about the root organization or business group. 3. Select the **Access Overview** tab. 1. Select the business group or environment from the dropdown to view a list of users with access to the selected business group or environment. 2. Select a permission from the dropdown to see a list of users with the selected permission in the selected business group or environment. 4. To see teams with access to the selected business group or environment, select **Teams** from the dropdown. 5. To see teams that have specific permissions assigned, select the permission from the dropdown. Permissions that are granted directly to users outside of the Teams feature aren’t shown. ### View Roles Associated with the Business Group 1. In the Access Management navigation menu, select **Business Groups**. 2. Click the name of the business group. The **Settings** section appears, showing details about the root organization or business group. 3. Select the **Roles** tab. ## Delete a Business Group Only an organization administrator that belongs to a business group can delete it. The top-level (root) business group can’t be deleted, even by an organization administrator. 1. In the Access Management navigation menu, click **Business Groups**. 2. Click the name of your root organization. 3. Click the **…​** menu for the business group to delete. 4. In the confirmation dialog, enter the name of the business group and then click **Delete**. ## Redistribute Resources Between Existing Business Groups You can redistribute resources (like vCores, VPCs, load balancers, small or large Managed Omni Gateways) between business groups at the business group level only, not at the root organization level. You must have the Organization Administrator permission for the root organization to redistribute resources. > [!NOTE] Allocating redistributable resources to a business group makes those resources available > only to that business group, which makes them unavailable to the parent organization. The business group hierarchy prevents a child business group from consuming additional resources from its parent group unless an organization administrator redistributes those resources to the child group. Resource distribution proceeds from root to parent to child. For example, you can’t redistribute sandbox VCores to a child business group if the parent business group doesn’t have any sandbox vCores available, even if the root organization has sandbox vCores available. Additionally, the root organization or parent business group can’t reclaim resources allocated to a business group that isn’t a direct child. 1. In the Access Management navigation menu, click **Business Groups**. 2. Click the name of the business group to reassign resources to. The **Settings** section appears, showing details about the root organization or business group. 3. Click the **Settings** tab. 4. Enter the number of vCores for the business group. 5. Click **Save changes**. The **Business Group Info** window includes a resource counter that shows a value representing available resources, the sum of those resources that are reassigned to child business groups, and resources currently in use by the selected business group. ### View Resource Usage To see resource utilization for the root organization, navigate to **Access Management > Subscription > Runtime Manage Subscription**. ## Client ID and Client Secret Each root business group, child business group, and environment, has its own associated unique client ID and client secret. These are used for authentication by users who aren’t business group administrators to access assets within a business group. The client ID and password are generated by Anypoint Platform for each environment you create, and they are globally unique. To deploy proxies or APIs to CloudHub, you must use these values to configure a customer-hosted Mule Runtime or legacy API Gateway. > [!NOTE] Business group-level client IDs and client secrets are supported only for backward > compatibility. In newer Anypoint Platform accounts, use the client ID and client secret for an > environment instead. See [Environments](https://docs.mulesoft.com/access-management/environments). ### View the Client ID and Secret for Environments 1. Sign in to Anypoint Platform using an account that has the Organization Administrator permission. 2. Select **Access Management** from the ![gear icon](/mulesoft/current/en-us/access-management/_images/gear.svg) menu. 3. In the Access Management navigation menu, click **Business Groups**. 4. Click the name of your root organization. 5. Click the **Environments** tab. 6. Click the name of the environment. 7. Next to the client secret, click **Show**. ### View the Client ID and Secret for Business Groups 1. Sign in to Anypoint Platform using an account that has the Organization Administrator permission. 2. Select **Access Management** from the ![gear icon](/mulesoft/current/en-us/access-management/_images/gear.svg) menu. 3. In the Access Management navigation menu, click **Business Groups**. 4. Click the name of your root organization. 5. Click the **Settings** tab. 6. Next to the client secret, click **Show**. > [!NOTE] > > - For newer Anypoint Platform accounts, the client ID and secret apply to environments rather than > business groups. See [Anypoint Platform Environments](https://docs.mulesoft.com/access-management/environments). > > - To change the client secret for an environment or business group, see > [How to Set Environment client\_secret in Anypoint Platform](https://help.salesforce.com/s/articleView?id=001115221&type=1), > or contact your customer support representative. ## Manage Root Business Group Settings Only users with the Organization Administrator permission can manage these settings. An organization administrator can modify the business group owner, name, domain name, and session timeout for its users. To access these settings: 1. Sign in to Anypoint Platform using an account that has the Organization Administrator permission. 2. Select **Access Management** from the ![gear icon](/mulesoft/current/en-us/access-management/_images/gear.svg) menu. 3. In the Access Management navigation menu, click **Business Groups**. 4. Click the name of your root organization. 5. Click the **Settings** tab. 6. Modify any of the following settings, then click **Save changes**. - **Name** This can be anything, for example, the name of the company. - **Owner** The owner of the business group. > [!NOTE] Business groups are hierarchical. The owner of a parent business group automatically > has and retains administrator permissions for any child business group of that parent, even > if they make another Organization Administrator user owner of a child business group. - **Organization domain** Although multiple business groups can be created by different users using the same business group name, each business group must have a unique domain name. > [!NOTE] Changing the name or domain name of a business group changes the deep links to any > existing API Portals in your business group. - **Default session timeout** Set the amount of time (in minutes) a user is inactive before they are automatically signed out of Anypoint Platform. The default is 60 minutes, the minimum is 15 minutes, and the maximum is 180 minutes. - **Confidentiality Notification** Create a custom window that appears when users log in to your business group. The character limit is 1000 alphanumeric characters and symbols: `@`, `:`, `?`, `!`, `,`, `.`, `;`, `'`, `_`, and `-`. You can also add line breaks using `\n` and tabs using `\t`. If you leave this field blank, users don’t receive a notification at signin. - **Runtime Manager** The default region for Runtime Manager. You can also view the business group ID, client ID, and client secret. These values apply to the root business group and grant permissions for all of the business groups contained within. To modify your [multi-factor authentication settings](https://docs.mulesoft.com/access-management/multi-factor-authentication) for your business group, click the **Identity Providers** in the Access Management navigation menu. Business groups created after April 30, 2022 require multi-factor authentication by default for all users. ## View Limits for a Business Group Each business group has a **Limits** section that shows how close it is to reaching the limits that are imposed by Anypoint Platform. To view limits: 1. In the Access Management navigation menu, select **Business Groups**. 2. Click the name of the business group. The **Settings** section appears, showing details about the root organization or business group. 3. Click the business group to view limits for. 4. Click the **Limits** tab. For more information on limits in Access Management, see [Limits](https://docs.mulesoft.com/access-management/troubleshooting-anypoint-platform-access#access-management-limits). ## Find your Business Group ID For some operations, it’s necessary to specify your business group (organization) ID, or _orgId_. You also need your business group ID to designate a business group or root business group when creating certain types of requests. You can get your business group ID from your business group URL, executing an Anypoint CLI command, or using a token to invoke the Anypoint Platform REST API. ### View Your Business Group URL After signing in to Anypoint Platform, you can view your business group ID by accessing [business groups](https://anypoint.mulesoft.com/accounts/businessGroups). 1. Sign in to Anypoint Platform. 2. Select **Access Management** from the ![gear icon](/mulesoft/current/en-us/access-management/_images/gear.svg) menu. 3. If you’re using the new feature UI (Teams feature is enabled): 1. In the Access Management navigation menu, click **Business Groups**. 2. In the tree that contains the root business group, click the root business group name. The URL in your browser’s address bar now appears in the following format: `[https://anypoint.mulesoft.com/accounts/businessGroups/](https://anypoint.mulesoft.com/accounts/businessGroups/\);`. The business group ID is `XXXXXXX-XXXX-XXXX-XXXX-XXXXXXX` in the example, and it appears after `businessGroups/` in your URL. 4. If you are using the classic UI (Teams feature is not enabled): 1. In the Access Management navigation menu, click **Business Groups**. A tree containing the root business group and child business groups appears. 2. Click the business group. The business group ID appears in the **Business Group Id** field. ## Use Anypoint CLI to Get Business Group Details If you have the [Anypoint CLI (command-line interface) tool](https://docs.mulesoft.com/anypoint-cli/latest/account) installed, you can use it to get a list of the business groups, their types, and the business group ID. For example, when you run the `account:business-group:list [flags]` command, your business group information appears in the following format:
NameTypeID

Great Company

Root

12345678-7831-8734-9999-a0a0a0a0a0a0

Retail

Business unit

abcdef01-1234-53e1-a3b4-b0b0b0b0b0b0

Engineering

Business unit

87654321-abcd-e8e2-bab4-c0c0c0c0c0c0

In the example, the ID next to `Root` is the business group ID. ## Invoke the Anypoint Platform REST API To get a token to invoke the Anypoint Platform REST API, see [How to generate your Authorization Bearer token for Anypoint Platform](https://help.salesforce.com/s/articleView?id=001115323&type=1). Then, invoke the URL `[https://anypoint.mulesoft.com/accounts/api/me](https://anypoint.mulesoft.com/accounts/api/me)` using the token. For example: `$ curl -H "Authorization: Bearer [YOUR_ACCESS_TOKEN]" [https://anypoint.mulesoft.com/accounts/api/me](https://anypoint.mulesoft.com/accounts/api/me)` ## Share Business Group Resources All API versions and CloudHub environments that you create in a business group are accessible only to users within the business group. To share resources with a user, invite the user to join your business group, and the user must accept the invitation and join the business group you sent the invitation from. See [Inviting Users](https://docs.mulesoft.com/access-management/users#inviting-users) for more information. > [!NOTE] Because the business group name (often the company name) isn’t necessarily unique, it > isn’t sufficient for the invited user to join the business group and use the company name > associated with the root business group. The organization domain name you set in the business > group information is what distinguishes your business group from other business groups. > > Invited users must use the link they receive in the invitation email to join your business group. If your business group is configured to use an external federated identity system, inviting users is unnecessary because they are authenticated by the external identity provider. After a user joins your business group, they have access to the resources associated with the permissions or roles assigned to them. You can assign permissions to grant users access to different resources within the business group. A best practice is to assign permissions to the user at the time you invite them to join your business group so the roles are in effect when the user signs in for the first time. If your business group contains business groups, you can give users access to multiple business groups by granting them permissions within each group. ## Connect MuleSoft Composer to Anypoint Platform Business groups that use both MuleSoft Composer and Anypoint Platform can connect the two products. To link MuleSoftComposer to Anypoint Platform: 1. Sign in to Anypoint Platform using an account that has the Organization Administrator permission. 2. Select **Access Management** from the ![gear icon](/mulesoft/current/en-us/access-management/_images/gear.svg) menu. 3. In the Access Management navigation menu, click **Composer Sync**. 4. In the **Composer Sync Orgs** page, click **Add Composer Orgs**. 5. In the **Add organization** window, in the **Organization ID** box, enter your Composer organization and then click **Add**. > [!NOTE] You can locate your Composer Organization ID by navigating to **Composer** > > **Settings** > **Account** > **General Information**. An email is generated and sent to the Composer organization admin, which provides a link to sync Anypoint Platform to Composer. ## See Also - [Anypoint Platform Business Groups](https://docs.mulesoft.com/access-management/business-groups) - [Using Roles to Manage Permissions](https://docs.mulesoft.com/access-management/roles) - [Using Teams to Manage User Permissions](https://docs.mulesoft.com/access-management/teams) - [Permissions in Anypoint Platform](https://docs.mulesoft.com/access-management/managing-permissions) - [Anypoint Platform Environments](https://docs.mulesoft.com/access-management/environments) --- product: Access Management version: master --- # Managing Connected Salesforce Orgs > For the full documentation index, see: https://docs.mulesoft.com/llms.txt As an Anypoint Platform organization administrator, you can enable, remove, and repair connections, and edit the name of Salesforce organizations. ## Enable the Connection in Anypoint Platform Enable the connection to a Salesforce organization that has an established tenant relationship with your Anypoint Platform organization. > [!NOTE] Tenant relationships that are automatically provisioned for your Anypoint Platform > organization are disabled until you enable them. You can’t publish assets from Anypoint Platform to the Salesforce organization or use any of the other features associated with the connected Salesforce organization until the connection is enabled. 1. Sign in to Anypoint Platform using an account that has the root Organization Administrator permission. 2. Select **Access Management** from the ![gear icon](/mulesoft/current/en-us/access-management/_images/gear.svg) menu. 3. Select **Salesforce**. If your organization has at least one established tenant relationship with a Salesforce organization, a list of Salesforce orgs appears, showing the name, organization ID, and status of the tenant relationship connection. 4. Click the **Actions** menu (**…​**) in the Salesforce organization to enable and select **Enable Org**. 5. In **Enable Salesforce Org**, click **Enable**. ## Remove the Connection Between Anypoint Platform and Salesforce Organizations When you remove the connection between your Anypoint Platform organization and Salesforce organization, the Salesforce organization no longer appears in the list of connected organizations. The connection still exists in the Salesforce organization until it’s removed by the Salesforce organization administrator. To reestablish the connection between Anypoint Platform and removed Salesforce organizations, administrators with the appropriate permissions in both Anypoint Platform and Salesforce organizations must recreate the connection. ### Remove a Connected Salesforce Org in Anypoint Platform An Anypoint Platform organization administrator can remove the connection between their Anypoint Platform organization and a connected Salesforce organization. When you remove a connection to a Salesforce organization, any capabilities associated with the Salesforce organization are removed. To remove the connection to a Salesforce organization: 1. Sign in to Anypoint Platform using an account that has the root Organization Administrator permission. 2. Select **Access Management** from the ![gear icon](/mulesoft/current/en-us/access-management/_images/gear.svg) menu. 3. Select **Salesforce**. 4. Click the **Actions** menu (**…​**) in the Salesforce organization to remove the connection from and select **Remove Salesforce Org**. 5. In **Remove Salesforce Org**, click **Remove Org**. ### Remove a Connected Anypoint Platform Organization in Salesforce A Salesforce organization administrator can remove the connection between an Anypoint Platform organization and Salesforce organization using the Salesforce user interface. To remove the connection to an Anypoint Platform organization in Salesforce: 1. Log in to your Salesforce organization with your admin credentials. 2. Go to **Setup**. ![Salesforce Setup menu with Setup selected](/mulesoft/current/en-us/access-management/_images/salesforce-setup.png) 3. From **Setup**, in the Quick Find box, enter `MuleSoft`, and then select **MuleSoft > Anypoint Platform Setup**. > [!NOTE] If you don’t see **MuleSoft > Anypoint Platform Setup** in your Salesforce org, > contact MuleSoft Support and provide your Salesforce org ID. Ask Support to turn on the > **Enable Flow API Actions** permission. 4. In **Your connected Anypoint Platform Organization**, click **View Connection Info**. 5. From **Go To Anypoint**, select **Remove connection**. 6. In **Remove connection to Anypoint Platform**, click **OK**. Alternatively, to temporarily prevent Anypoint Platform users from publishing assets to Salesforce from the Anypoint Platform side, you can [disable](#enable-disable-connection) the connection temporarily instead. For more information about managing this relationship from the Salesforce user interface, see the [Salesforce documentation](https://help.salesforce.com/s/articleView?id=platform.external_services_manage_your_mulesoft_anypoint_platform_connection.htm&type=5). ## Repair the Connection to a Salesforce Organization If the Salesforce **My Domain** is changed in the connected Salesforce organization, you can rediscover the Salesforce organization and repair the connection. 1. Sign in to Anypoint Platform using an account that has the root Organization Administrator permission. 2. Select **Access Management** from the ![gear icon](/mulesoft/current/en-us/access-management/_images/gear.svg) menu. 3. Select **Salesforce**. 4. Click the **Actions** menu (**…​**) in the Salesforce organization and select **Repair Org Info**. 5. Click **Repair** to rediscover the Salesforce organization. ## Edit the Salesforce Organization Name You can edit the Salesforce organization display name in your Anypoint Platform organization. The name of the Salesforce organization within Salesforce remains the same. To edit a Salesforce organization name: 1. Sign in to Anypoint Platform using an account that has the root Organization Administrator permission. 2. Select **Access Management** from the ![gear icon](/mulesoft/current/en-us/access-management/_images/gear.svg) menu. 3. Select **Salesforce**. 4. Click the **Actions** menu (**…​**) in the Salesforce organization and select **Edit Org Name**. 5. Enter the name for the Salesforce organization and click **Save**. The Salesforce organization name appears in Anypoint Platform anywhere the organization is referenced. ## Copy Your Anypoint Platform Organization ID 1. Sign in to Anypoint Platform using an account that has the root Organization Administrator permission. 2. Select **Access Management** from the ![gear icon](/mulesoft/current/en-us/access-management/_images/gear.svg) menu. 3. Select **Salesforce**. 4. Click the **Actions** menu (**…​**) and select **Get Anypoint Platform Organization ID**. 5. Click **Copy**. ## See Also - [Salesforce Organization Connections in Anypoint Platform](https://docs.mulesoft.com/access-management/trusted-salesforce-org) - [Enable or Disable Capabilities for a Connected Salesforce Organization](https://docs.mulesoft.com/access-management/manage-capabilities) --- product: Access Management version: master --- # Managing External Identity Providers in Anypoint Platform > For the full documentation index, see: https://docs.mulesoft.com/llms.txt Configure up to 25 external identity providers (IdPs) in Anypoint Platform to enable single sign-on (SSO) for your organization. Anypoint Platform supports SAML 2.0 and OpenID Connect (OIDC) configurations for SSO providers. If you are using the Access Management API, note the following: - Old endpoints that aren’t scoped to new IdPs are replaced with new endpoints. - IdPs created before October 31, 2021 are backwards compatible with old endpoints. - If a legacy IdP is deleted, then old endpoints are no longer supported, even if the legacy IdP is re-added. ## Managing User Identities with Anypoint Platform By default, user identities and credentials in your Anypoint Platform organization are managed by Anypoint Platform in Access Management. You can disable this functionality after you add one or more external identity providers. Organizations that use Anypoint Platform to manage user identities control whether new users are added to the organization using either Access Management settings or an external identity provider. Organizations that don’t require multi-factor authentication (MFA) for their user accounts choose to enable or disable MFA and exempt accounts. If an organization requires MFA, administrators manage exempt accounts in the **Identity Providers** section using the **Anypoint** settings. ## Before You Begin Before getting started, ensure that you have: - The Organization Administrator permission - An OpenID Connect or SAML 2.0 identity provider ## Manage Identity Providers Access your list of identity providers, configure settings, and add additional identity providers. 1. Sign in to Anypoint Platform using an account that has the Organization Administrator permission. 2. Select **Access Management** from the ![gear icon](/mulesoft/current/en-us/access-management/_images/gear.svg) menu. 3. In the Access Management navigation menu, click **Identity Providers**. A list of identity providers appears. ## Add Identity Providers 1. Click **Add Identity Provider**, and then select the identity provider type you want to add: - [OpenID Connect](https://docs.mulesoft.com/access-management/conf-openid-connect-task) - [SAML 2.0](https://docs.mulesoft.com/access-management/conf-saml-sso) ## Delete Identity Providers If you have more than one identity provider configured, delete external identity providers that you no longer need. Before deleting an IdP, ensure that your users' credentials and permissions structures are configured with a different IdP, such as the native Anypoint Platform IdP or an external IdP. When you delete an IdP: - Users can no longer use this IdP to sign in to Anypoint Platform. - Any external team or role group mappings associated with this IdP are deleted. - The Access Management API endpoints associated with this IdP are no longer supported. To delete an identity provider: 1. Sign in to Anypoint Platform using an account that has the Organization Administrator permission. 2. Select **Access Management** from the ![gear icon](/mulesoft/current/en-us/access-management/_images/gear.svg) menu. 3. In the Access Management navigation menu, click **Identity Providers**. 4. Next to the identity provider to delete, click the **…​** menu. 5. Click **Delete…​** 6. In the **API Update** window, click **Continue**. 7. Enter the name of your identity provider. 8. Click **Delete**. ## Enable Users to Link Anypoint Platform Profiles As an organization administrator, you can enable users to link multiple Anypoint Platform profiles that use the same email address to sign in. The option to link profiles is available only when the SSO user signs in to their new Anypoint Platform account for the first time. Anypoint Platform supports: - Linking an SSO signin to a local profile by using credentials (signin managed by Anypoint IdP) - Linking an SSO signin to another SSO signin that uses a different IdP - Linking an SSO signin to multiple other profiles that use different IdPs Anypoint Platform doesn’t support linking multiple profiles that use the same IdP. Anypoint Platform supports only OpenID Connect (OIDC) IdPs. 1. Sign in to Anypoint Platform using an account that has the Organization Administrator permission. 2. Select **Access Management** from the ![gear icon](/mulesoft/current/en-us/access-management/_images/gear.svg) menu. 3. In the Access Management navigation menu, click **Identity Providers**. 4. In the **Link Multiple SSO Profiles** section, click **Enabled**. 5. Click **Save Changes**. Users in your organization can now link their SSO logins with other IdP profiles that share the same email address. ## Remove a Linked Profile From a User Account To remove a linked profile from a user account, organization administrators make a `DELETE` call to `/accounts/api/organizations/:orgId/users/:userId/identityProviderProfiles`. For details, see the [Access Management API documentation](https://dev-portal.mulesoft.com/apis/access-management.html). ## Enable or Disable Account Creation If your organization has single sign-on (SSO) using an [external identity provider](https://docs.mulesoft.com/access-management/external-identity) enabled, you can prevent users from creating accounts that do not use SSO. To modify account creation parameters: 1. Sign in to Anypoint Platform using an account that has the Organization Administrator permission. 2. Select **Access Management** from the ![gear icon](/mulesoft/current/en-us/access-management/_images/gear.svg) menu. 3. In the Access Management navigation menu, click **Identity Providers**. 4. Click **Anypoint**. 5. Select one of the following: 1. **Allow account creation**: Organization administrators can invite new users using the **Users** tab. Accounts created using this feature belong to the Anypoint identity provider and sign in using their credentials rather than SSO. 2. **Disable account creation**: New accounts must join the organization using an external identity provider and sign in using SSO. Existing accounts are unaffected and can continue to sign in using their credentials. 6. Click **Save Changes**. --- product: Access Management version: master --- # Managing IP Allowlists in Access Management > For the full documentation index, see: https://docs.mulesoft.com/llms.txt Create IP allowlists in Access Management to restrict access to your Anypoint Platform organization to trusted networks. Enforce IP restrictions for Anypoint Platform logins by adding CIDR blocks to reduce credential abuse and meet compliance needs. > [!NOTE] > > - This feature is available only for US and EU commercial clouds. > > - IP allowlisting applies only to users who sign in with Anypoint Platform credentials. It doesn’t > apply to users who authenticate through an external identity provider (IdP) using SSO. ## Before You Begin - Have the root Organization Administrator permission for your organization. ## Enable or Disable IP Allowlisting Enable or disable IP allowlisting for your organization’s logins in Access Management. When this feature is enabled, only logins from IP addresses in allowed CIDR blocks succeed. Login attempts outside the IP allowlist are blocked and logged. 1. Log in to Anypoint Platform using an account that has the root Organization Administrator permission. 2. Select **Access Management** from the ![gear icon](/mulesoft/current/en-us/access-management/_images/gear.svg) menu. 3. In the Access Management navigation menu, select **Security Settings**. 4. In **IP Allowlist**, enter the IP address CIDR blocks to allow to log in. For example: - IP Address CIDR: `192.0.2.0/24` - Description: `NE office network` > [!NOTE] Only IPv4 addresses are supported. All defined CIDR blocks apply to all users in > your organization unless they’re exempted. 5. (Optional) Click **Add** or **Remove** to add and remove CIDR blocks. 6. Switch the **Enforce IP restrictions for login** switch on or off to activate or deactivate defined IP restrictions for all users within your organization. If there aren’t any CIDR blocks configured, this option is disabled. 7. Click **Save**. ## Manage IP Allowlist Exemptions You can exempt specific users from the organization-wide IP allowlist restrictions. > [!NOTE] Root organization administrators are subject to IP enforcement unless explicitly exempted, > and they’re allowed to self-exempt. 1. Log in to Anypoint Platform using an account that has the root Organization Administrator permission. 2. Select **Access Management** from the ![gear icon](/mulesoft/current/en-us/access-management/_images/gear.svg) menu. 3. In the Access Management navigation menu, select **Users**. 4. Select the user to exempt and then select **Settings**. 5. Select **Exempt user from IP restrictions**, and then click **Save** to apply the exemption. ## Audit Logging These actions are logged in the audit log: - Create, update, and delete actions performed by an Organization Administrator on the allowlist - Signin failures due to IP restrictions ## See Also - [Managing Security Settings](https://docs.mulesoft.com/access-management/managing-security-settings) --- product: Access Management version: master --- # Managing Security Settings > For the full documentation index, see: https://docs.mulesoft.com/llms.txt Configure organization-wide security controls in Anypoint Platform to protect access and reduce risk. Enforce multi-factor authentication, restrict sign-ins by IP address, and allowlist trusted domains to meet compliance requirements. Use centralized controls to harden account security for all users and integrations. Manage these settings in Access Management: - [Enabling and Managing Multi-Factor Authentication in Anypoint Platform](https://docs.mulesoft.com/access-management/multi-factor-authentication) - [Managing IP Allowlists in Access Management](https://docs.mulesoft.com/access-management/managing-ip-allowlists) - [Allowlisting Trusted Domains in Anypoint Platform](https://docs.mulesoft.com/access-management/allowlisting-trusted-domains) ## See Also - [Managing your Anypoint Platform Account](https://docs.mulesoft.com/access-management/managing-your-account) - [Permissions in Anypoint Platform](https://docs.mulesoft.com/access-management/managing-permissions) - [Managing Business Groups in Anypoint Platform](https://docs.mulesoft.com/access-management/managing-business-groups) --- product: Access Management version: master --- # Managing Users > For the full documentation index, see: https://docs.mulesoft.com/llms.txt Control who has access to your Anypoint Platform organization by managing user accounts. As an organization administrator, you can invite users, assign permissions, update user settings, enable and disable users, and remove users when needed. ## Before You Begin Make sure that you have the required permissions: - Organization Administrator permission (required for all user management tasks) - API Version Owner permission (required only if you manage user permissions for your API version) ## Invite a User to Anypoint Platform > [!NOTE] This feature isn’t available in Anypoint Platform Private Cloud Edition, Government Cloud, > or for organizations that use external identity providers for single sign-on (SSO) and have > [disabled account creation](https://docs.mulesoft.com/access-management/external-identity-index#account-creation-changes). You must manage > users, including invitations for new users, through your third-party IdP or LDAP. As an organization administrator of a business group, you can invite new users and manage existing users for your organization. To invite new users to your organization: 1. In the Access Management navigation menu, click **Users**. 2. Click **Invite user**. 3. Enter the email addresses of the users that you want to invite to your organization as a comma-separated list. 4. Optionally, select a [team](https://docs.mulesoft.com/access-management/teams) or [role](https://docs.mulesoft.com/access-management/roles) to assign permissions to these users. 5. Click **Send Invitation**. The users you specify receive email invitations to join your organization. The invitation link expires after one week. When they click the link, they are presented with a sign-up form that already has the **Company** field completed with the name of your organization. Invited users have access to the same set of resources as you (although they may have different permissions that restrict what they can view or do). ## Resend or Cancel a Sent Invitation If a user didn’t receive an invitation or the invitation link expired, resend the invitation. The new invitation link expires after one week. 1. In the Access Management navigation menu, click **Users**. 2. Click **Pending Invites** to view all invitations that have not yet been accepted. 3. Click the more actions menu (**…​**) in the row for the invitation to manage. 4. Select **Re-send Invite** or **Cancel Invite**. ## Invitation, Welcome, and License Key Emails Anypoint Platform users receive these types of emails:
EmailWhen it’s sentHow to resend it

Invitation email

An organization administrator invites a user from the Users page.

An organization administrator resends it from Pending Invites. See Resend or Cancel a Sent Invitation.

Welcome email

MuleSoft provisions a new organization

You can’t resend it from Anypoint Platform. Contact your MuleSoft Account Executive or provisioning team for help.

License key email

MuleSoft fulfills a Mule runtime license order

You can’t resend it from Anypoint Platform. Contact your MuleSoft Account Executive or provisioning team for help.

## Access the User’s Settings Page The user’s **Settings** page is where you can edit the user’s first and last name, email address, and exempt them from multi-factor authentication. 1. In the Access Management navigation menu, click **Users**. 2. Access the user’s **Settings** page: - Click the user’s name in the **Name** column. - Click the username in the **Username** column. - Click the more actions menu (**…​**) in the user’s row, and select **Manage User**. 3. Click the **Settings** tab. ## Grant Permissions to Users Organization administrators manage user access using [teams](https://docs.mulesoft.com/access-management/teams) or [roles](https://docs.mulesoft.com/access-management/roles), or by granting permissions to users individually. Teams and roles functionality are mutually exclusive. For more information about configuring Teams, see [Manage Team Permissions](https://docs.mulesoft.com/access-management/configure-teams#manage-team-permissions). In the **Users** page, click a user name to access more information about that user, manage and view permissions, manage and view teams, or reset their password. You can assign permissions in these areas: - **API permissions**: Grant access to specific APIs by selecting the API name, version, and permission level. - **Runtime Manager permissions**: Grant access to Runtime Manager environments by selecting the environment and permission level. - **Teams**: Add users to teams with predefined permission sets. - **Roles**: Assign predefined roles that bundle multiple permissions. See [Roles](https://docs.mulesoft.com/access-management/roles) for descriptions of default roles. To grant permissions to individual users: 1. Sign in to Anypoint Platform using an account that has the Organization Administrator permission. 2. Select **Access Management** from the ![gear icon](/mulesoft/current/en-us/access-management/_images/gear.svg) menu. 3. In the Access Management navigation menu, click **Users**. 4. Click the name of the user to assign permissions to. 5. Click the **Permissions** tab and click **Add permissions**. 6. Select the permissions to add and click **Next**. 7. Select the business groups to apply the permissions to. If environment-level permissions are available, select which environments to apply the permission to. 8. Click **Next**. 9. Review the permissions and the business groups and environments they apply to, and then click **Add Permissions**. The user now has the permissions you selected in the business groups and environments you specified. ## Remove Permissions for a User You can remove user permissions for an individual user, but if those permissions are granted through an assigned team, you can remove them only by using the [Teams](https://docs.mulesoft.com/access-management/teams) feature. You can’t view or remove team-based permissions in the **Users** page. To edit or remove permissions for an individual user: 1. Sign in to Anypoint Platform using an account that has the Organization Administrator permission. 2. Select **Access Management** from the ![gear icon](/mulesoft/current/en-us/access-management/_images/gear.svg) menu. 3. In the Access Management navigation menu, click **Users**. 4. Click the name of the user to edit permissions for. 5. In the row that has the permissions to edit, click **Edit**. The **Edit Permissions** dialog shows the permissions that are assigned to the user. 6. Deselect the permissions to remove from the user, and then click **Done**. ## View Limits for a User Each administrative page for a user contains a **Limits** section that shows how close the account is to hitting limits imposed by Anypoint Platform. To view limits: 1. In the Access Management navigation menu, click **Users**. 2. Click the user for which you want to view limits. 3. Click the **Limits** tab. > [!NOTE] The number of permissions used might include internal permissions granted automatically by > the system, which are not always visible in the UI. For more information on limits in Access Management, see [Limits](https://docs.mulesoft.com/access-management/troubleshooting-anypoint-platform-access#access-management-limits). ## Manage Deleted Users When you delete a user from your root organization, the user is _soft deleted_. The deleted user can no longer access the root organization or business groups but maintains an Anypoint Platform account and can later be associated with another organization. Anypoint Platform maintains a record of such users for the purposes of audit logs. Deleting a user does not affect the assets created by that user. For instance, deleting a user who has created an API in Exchange, an API in API Manager, or an application in Runtime Manager does not have any impact on the assets they created. An Anypoint Platform user can’t sign into an organization they were removed from. If a user tries to sign in to an organization they were removed from, they are added to a new trial organization as an administrator. An organization administrator can invite a user to rejoin the organization they were previously removed from, but the user must create a new username. A deleted federated user appears in the organization as a disabled account. An organization administrator can reenable this user. ## Manage External Users of Your Public APIs When you make an API portal public, users from any other Anypoint Platform organization can register client applications to call your API. When these users sign in to your public developer portal, they are considered external users because they are outside of your organization. When a user logs into Anypoint Platform for the first time, they are automatically added to the **External Users** tab. From the **External Users** tab in Access management, you can view a list of all external users. You can also enable or disable each of these external users from this screen. When you disable an external user, they can no longer log in to your public portal. You cannot search for external users in other parts of Anypoint Platform because these users do not belong to your organization and do not have additional permissions. To grant users permission to perform tasks like deploying an application, you must invite the user to join your organization. ## Manage Sensitive Account Information As an organization administrator, you can modify some sensitive user information. For enhanced security, Access Management might ask you to reauthenticate before you can modify an organization user’s email address. Connected apps and clients are exempt from reauthentication. If you have a script that makes an API call to change an organization user’s email addresses, it might need to accommodate reauthentication. Access Management prompts you to reauthenticate when: - More than 30 minutes have elapsed since you entered your password, Access Management prompts you to reenter your password. - You have multifactor authentication (MFA) enabled and more than eight hours have elapsed since you entered your password and used MFA, Access Management prompts you to reenter your password and confirm the signin using MFA. Each time you sign in or reauthenticate, the timer resets. If less than 30 minutes have elapsed since you signed in, Access Management does not prompt for your password again. ## See Also - [To Share an Asset or Publish to a Portal](https://docs.mulesoft.com/exchange/to-share-an-asset) - [Managing Users with an External Identity Provider](https://docs.mulesoft.com/access-management/external-identity#managing-users-external-identity) - [SSO through a Third-party IdP](https://docs.mulesoft.com/access-management/external-identity#instructions-for-saml-configuration) - [LDAP](https://docs.mulesoft.com/access-management/external-identity#configure-ldap) --- product: Access Management version: master --- # Managing your Anypoint Platform Account > For the full documentation index, see: https://docs.mulesoft.com/llms.txt Create a new Anypoint Platform account, sign in to an existing Anypoint Platform organization through an invitation, use your current account to access a new organization, and set up a new account within an existing organization. You can also sign in to Anypoint Platform using single sign-on and allowlist URLs for uninterrupted access. ## Create an Anypoint Platform Account 1. Go to [the signup page](https://anypoint.mulesoft.com/login/signup). 2. Enter your information in the form: - **Email** You can use the same email address for multiple Anypoint Platform accounts, but each account must have a unique username so you can manage all your Anypoint Platform accounts under a single email address. - **Username** Must be at least three characters and contain only: - Alphanumeric characters - Dashes - Underscores - **Phone Number** Phone number with area code. - **Password** Must be between 8 and 64 characters in length with at least one uppercase letter, one lowercase letter, and one number. Your password can contain only: - Upper and lower case characters - Numbers - Non-alphanumeric symbols - **Company** Must be at least two characters in length. If you were invited to join an existing organization, the company name is already set. Anypoint Platform creates a new root organization (business group) using the company name you entered and makes you the administrator of that organization. An Anypoint Platform account is associated with only one root organization. 3. Click the terms of service link to read the Anypoint Platform Trial License agreement, then check the box to agree to the terms of service. 4. Click the **I’m not a Robot** CAPTCHA checkmark and wait for validation. > [!NOTE] You might be prompted to perform a small test before proceeding. > [!TIP] Google’s reCaptcha verification service autodetects your browser’s language. 5. Click **Accept and create account**. ## Join an Existing Organization To join an existing Anypoint Platform organization or create a new account in an existing organization, ask the organization administrator for an invitation. When the administrator responds with an email invitation, you must click the included link within one week. 1. Click the link you received in the Anypoint Platform invitation email. You must use the email address the invitation email was sent to to sign up for an account with that organization. 2. Enter your information in the form. If your email address is associated with more than one Anypoint Platform account, after clicking the link in the invitation select either: - [Use an Existing Account](#use_existing_account), or - [Create a New Account Within an Existing Organization](#create-new-account) 3. Agree to the terms of service and privacy policy, then click **Accept and create account in **. > [!NOTE] You can’t create a new account within an existing organization without an email > invitation. ## Use an Existing Account You can use an existing account to join an existing organization after you receive an invitation. For example, if you’re invited to join the **MuleSoft** Organization, and you have three different Anypoint Platform accounts: - Member An account not associated with any organization. - Admin An account with the organization administrator role associated to a different organization. - Owner An organization owner account for a different organization. After clicking the link in the invitation, you have one week to choose the account to use to join the organization. > [!NOTE] If the account you want to use is already associated with another root organization, an > exclamation mark is shown next to your account. Additional steps are needed before migrating the > account to a new organization. ## Sign in to Anypoint Platform 1. Navigate to the Anypoint Platform signin screen. 2. Enter your username and password. 3. Click **Sign in**. > [!NOTE] If Anypoint Platform rejects your valid credentials, your organization uses an > [external identity provider](https://docs.mulesoft.com/access-management/external-identity) to initiate the sign-in process. Navigate to your > external identity provider to sign in, or > [enter your organization’s domain name](#use-CustomDomainLogin) before reentering your > credentials. ## Sign in to Anypoint Platform Using Single Sign-on If your organization uses [Single Sign-on](https://docs.mulesoft.com/access-management/external-identity), provide your organization’s domain name as part of the sign-in process. 1. Navigate to the Anypoint Platform signin screen. 2. Click **Use custom domain**. 3. Enter your organization’s domain name. If you don’t know your organization’s domain name, a member of your organization can provide the organization domain name, which is accessible in their user profile. 4. Click **Continue**. You’re redirected to your identity provider. ## Allowlist URLs to Sign in to and Use Anypoint Platform To make sure your sessions aren’t blocked or interrupted by your organization’s firewall or proxy if you use a restricted environment, such as a virtual machine, or have proxy requirements preventing you from signing in to Anypoint Platform, add these URLs to your allowlists: - `https://*.mulesoft.com/*` - `https://*.salesforce.com/*` - `https://app.launchdarkly.com/*` - `https://clientstream.launchdarkly.com/*` - `https://www.gstatic.com/recaptcha/*` - `https://www.google.com/recaptcha/*` - `[https://npmcdn.com/*](https://npmcdn.com/*)` - `[https://cdnjs.cloudflare.com/*](https://cdnjs.cloudflare.com/*)` - `[https://fast.appcues.com/*](https://fast.appcues.com/*)` ## Use an Unassociated Account When an organization administrator deletes an account from the organization, the deleted account is _unattached_. You can use an unattached account to join the **MuleSoft** organization with no further configurations needed. Select the account, enter its corresponding password, and click **Sign in**. ## Use an Organization Administrator Account If your account is an organization administrator for a different organization (or business group within that organization), your username is shown with an exclamation mark next to it. You can use this account to join **MuleSoft**, however all existing references from this account to the existing organization are lost. After selecting this account and entering the password associated with it, you’re asked to confirm your decision. If you proceed: - If there are other members in the business group you’re leaving, the organization administrator of the parent organization is automatically assigned as the organization administrator for the business group. - If there are no other members, the business group is deleted. ## Account Associated as an Organization Owner A common scenario is to create an account that’s not associated with any existing organization. This automatically assigns your account to a new organization and makes your account an organization owner. After selecting this account, entering its corresponding password, and clicking the **Sign in** button, if there are no other members in the organization you own: - You get a warning that all associations to the existing organization will be lost. - The organization you’re leaving will be deleted. However, if the organization your account owns has other members, Anypoint Platform won’t allow you to migrate to **MuleSoft**. To free your account from the organization you own, open a support ticket at [https://help.salesforce.com](https://help.salesforce.com). Provide this information: - The username of another user within the organization you own to promote to owner - The organization name and organization ID of the organization After support confirms the migration is complete, you can use your account to join MuleSoft. > [!NOTE] If you have a trial account at no additional cost and want to migrate your username to a > new organization, another organization administrator in your current organization must delete your > organization owner account from the organization associated with your trial account. ## Link Your Anypoint Platform Profiles When you sign in to Anypoint Platform for the first time using an external identity provider (IdP), Anypoint Platform locates potential user accounts that match the email address associated with your IdP profile. Your options for linking profiles vary based on whether the profiles use the Anypoint Platform IdP or an external IdP that uses single sign-on (SSO). Anypoint Platform supports: - Linking an SSO signin to a local profile by using credentials (signin managed by Anypoint IdP) - Linking an SSO signin to another SSO signin that uses a different IdP to sign in - Linking an SSO signin to multiple other profiles that each use different IdPs to sign in Anypoint Platform doesn’t support linking multiple profiles that use the same IdP. The IdP must be an OpenID Connect (OIDC) provider. You can link up to 25 user profiles. This feature is available only if an [organization administrator has enabled it](https://docs.mulesoft.com/access-management/external-identity-index#enable-profile-linking). ### Link a New SSO Signin to Existing Profiles When you sign in using SSO for the first time and there are additional user profiles that share the same email address but use different identity providers (IdPs), Anypoint Platform prompts you to link the profiles. You can’t link profiles that use the same IdP. 1. In the Anypoint Platform signin page, click **Sign in with **. 2. If prompted, enter your credentials for your IdP. If your SSO credentials share an email address with additional profiles in the same organization, you are prompted to select one of the profiles and sign in with those credentials to link your profiles. 3. In the **Link your Account** page, select the profile you want to link. Hover over each profile to see which identity provider it uses. 4. Click **Link Accounts**. 5. Enter your credentials for the profile you chose. Your linked profile now appears in the **Logged In Via** section of your user profile. ## Update User Information 1. Sign in to Anypoint Platform. 2. In the Anypoint Platform navigation bar, click the circle icon with the initials associated with your Anypoint Platform account and select your name. You can modify your contact information, change your password, and see a list of the permissions assigned to your account. ### Manage Sensitive Account Information For enhanced security, Access Management might prompt you to reauthenticate before you can modify your email address. Access Management prompts you to reauthenticate when: - More than 30 minutes have elapsed since you entered your password, Access Management prompts you to reenter your password. - You have multifactor authentication (MFA) enabled and more than eight hours have elapsed since you entered your password and used MFA, Access Management prompts you to reenter your password and confirm the signin using MFA. Each time you sign in or reauthenticate, the timer resets. If less than 30 minutes have elapsed since you signed in, Access Management does not prompt for your password again. Connected apps and clients are exempt from reauthentication. If you have a script that makes an API call to change your email address, update it to accommodate reauthentication if necessary. ### Verify Your Email Address As of October 10, 2022, non-SSO users must verify their Anypoint Platform email addresses. If you haven’t verified your email address, an email verification request prompt appears each time you sign in. You can verify your email using the sign in prompt, or you can verify your email in your user profile. SSO users can’t verify their email addresses through Anypoint Platform and don’t receive verification prompts. 1. Sign in to Anypoint Platform. 2. In the Anypoint Platform navigation bar, click the circle icon with the initials associated with your Anypoint Platform account and select your name. 3. Click the **Contact Info** tab. 4. In the **Email** section, click **Verify Email**. 5. Enter the verification code you received at your Anypoint Platform account’s email address. The verification email can take a few minutes to arrive. If you don’t see the email in your inbox after several minutes, check your Spam folder. 6. Click **Confirm**. ## Change Your Account Email Address You can change the email address that you use to sign in to your Anypoint Platform account. > [!NOTE] SSO users can’t change their account email address through Anypoint Platform. 1. Sign in to Anypoint Platform. 2. In the Anypoint Platform navigation bar, click the circle icon with the initials associated with your Anypoint Platform account and select your name. 3. Click the **Contact Info** tab. 4. In the **Email** row, click the pencil icon. 5. Enter your new email address. 6. Click **Save Changes**. 7. If you’re signed in to Anypoint Platform for more than 30 minutes, reenter your password to reauthenticate. 8. Enter the verification code you received at the new email address you entered. 9. Click **Confirm**. The email address you entered is now your primary email address for Anypoint Platform. ## Reset Your Password When you reset your password, your new password must be between 8 and 64 characters in length with at least one uppercase letter, one lowercase letter, and one number. Your password must contain only ASCII-standard characters. You can’t reuse any of your previous three passwords. 1. Navigate to the Anypoint Platform signin page. 2. Click the **Forgot your username or password** link. 3. In the **Forgot your credentials** form, enter your username. A link to create a new password is emailed to you. 4. Click the reset password link in the email. 5. In the **Reset your password** form, enter a new password and click **Reset Password**. ## Forgot User Name 1. Navigate to the Anypoint Platform signin page. 2. Click the **Forgot your username or password** link. 3. In the **Forgot your credentials** form, enter the email address you used for your Anypoint Platform account, then click **Request credentials**. You receive an email from Anypoint Platform with a list of user names associated with your email address. ## Upgrade Your Account To upgrade your Anypoint Platform trial account to an enterprise license, contact your account representative or [the MuleSoft sales team](https://www.mulesoft.com/contact). ## Known Issue: Account Creation When you attempt to create an account from an email invitation to join an organization, and you use a username that already exists (even in a different organization), an error appears, erroneously stating your credentials are invalid. This error occurs when a username already exists, even if it is under a different organization. If the username already belongs to you, you can move the username from your previous organization to the organization that sent you the email invitation. --- product: Access Management version: master --- # Mapping Single Sign-On Users to Roles or Teams in Anypoint Platform > For the full documentation index, see: https://docs.mulesoft.com/llms.txt Map the users in a federated organization’s group to a team or role to maintain secure credentials and organizational structure for accessing privileged information. Users in an external organization can then log in to Anypoint Platform using the same organizational credentials and access permissions that an external organization maintains using SAML, OpenID Connect (OIDC), or LDAP. Anypoint Platform requires different information from your identity provider (IdP) based on whether you use SAML, OpenID Connect, or LDAP. User mappings apply only to the IdP you configured them for. ## Before You Begin - Have the Organization Administrator permission in the root Anypoint Platform organization. - Configure an external identity provider (IdP), such as PingFederate, for your Anypoint Platform organization. - Create and configure the single sign-on (SSO) app in your IdP. - Make sure the user or identity of the group of users is created in the identity provider. ## Add Group Mappings 1. Sign in to Anypoint Platform using an account that has the Organization Administrator permission. 2. Select **Access Management** from the ![gear icon](/mulesoft/current/en-us/access-management/_images/gear.svg) menu. 3. In the Access Management navigation menu, click **Teams**. 4. Select the team to add the external IdP group to. 5. Select **External IdP Groups**. 6. Enter the name of the group in **Group Name**. 7. In **Provider Name**, select the name of the identity provider. 8. In **Type**, select **Member**, and then click **Add**. 9. Click **Save Changes**. The SSO users associated with the group you mapped are assigned to the team. ## Configure Multiple Group Mappings for Single Sign-On Using SAML If your organization uses single sign-on but requires permissions from multiple groups, configure an attribute that contains all the groups for individual access permission. You can also create an array of groups. For example, if your IDP provides your groups in this format, you must create an attribute that encompasses multiple group mappings to prevent security vulnerabilities: Mule\_Org\_Admin\_XXX Mule\_Exchange\_XXX In this example of a SAML assertion, the **Group Attribute** is `Groups`: Mule\_Org\_Admin\_XXX Mule\_Exchange\_XXX Verify that the value in the **Group Attribute** field matches the name of the SAML attribute that contains the group names. ## Configure Multiple Group Mappings for Single Sign-On Using OpenID Connect (OIDC) External identity providers format groups claims in different ways. Anypoint Platform checks the `UserInfo` response for the groups claim. If the response for the groups claim isn’t found, Anypoint Platform then checks the `Token` endpoint response. Use groups claims values to create a team or role for each group of users in your organization: 1. Obtain a response to the `UserInfo` or `Token` endpoint that contains a groups claim from your external identity provider. 2. If your IdP requires an additional OIDC scope to authorize access to groups claims, enter it in the **Group Scope** field. 3. Verify that the [JSONata](https://jsonata.org) query in **Group Attribute JSONata Expression** yields an array of group names from either the `UserInfo` or `Token` endpoint response. ### Examples of OIDC Group Expressions These examples show responses from the `UserInfo` or `Token` endpoints that contain groups claims from different external identity providers. #### Entra ID This example shows a typical Entra ID groups claim: ```xml { ... "roles": "[ \"Everyone\", \"groupOne\" ]", ... } ``` Given that groups claim, the JSONata expression is `$eval($string(roles))`. #### Okta This example shows a typical Okta groups claim: ```xml { ... "groups": [ "Everyone", "groupOne" ] } ``` Given that groups claim, the JSONata expression is `groups`. #### Auth0 This example shows a typical Auth0 groups claim: ```xml { ... "https://anypoint.mulesoft.com/groups": [ "MyGroup", "groupOne" ] } ``` Given that groups claim, the JSONata expression is https://anypoint.mulesoft.com/groups. #### Salesforce This example shows a typical Salesforce groups claim: ```xml { ... "custom_attributes": { "PermissionSets": "groupOne,groupTwo" } } ``` Given that groups claim, the JSONata expression is `$split(custom_attributes.PermissionSets, ',')`. ## Configure Multiple Group Mappings for Single Sign-On Using LDAP You can obtain the information you need to map your LDAP group to a team or role using a SAML assertion. > [!NOTE] User management through LDAP is available only for Anypoint Platform Private Cloud > Edition. This is an example string from the SAML assertion `AttributeValue` to the **External group name**: ```xml cn=jira-users,ou=groups,dc=muleforge,dc=org ``` This shows an example of an external group mapping: ![An example of a list of external group names](/mulesoft/current/en-us/access-management/_images/external-identity-cfb1e.png) ## Map SSO Users to Teams > [!NOTE] If you delete your IdP configuration, your associated team mappings are also deleted. You can map SSO users to teams by including their group names. If a user has multiple group names that map to a single team, the group name that grants the most permissions is used. For example, if the Acme team has a Member group of `engineering-all` and a Maintainer group of `engineering-managers`, a user with both `engineering-all` and `engineering-managers` group names becomes a maintainer. If a user is explicitly designated as a maintainer of a team and has a group name that gives them member status, the group name is ignored, and the user remains a maintainer. 1. Sign in to Anypoint Platform using an account that has the Organization Administrator permission. 2. Select **Access Management** from the ![gear icon](/mulesoft/current/en-us/access-management/_images/gear.svg) menu. 3. In the Access Management navigation menu, click **Teams**. 4. Click the team to modify. 5. Click the **External IdP Groups** tab. 6. In the **Group Names** field, enter one of the following: - SAML: The group attribute that comes from your array of SAML groups - OIDC: The groups claims values that come from the `UserInfo` or `Token` endpoint responses - LDAP: The string from your SAML assertion AttributeValue 7. In the **Type** drop-down, select `Member` or `Maintainer`. If you select **Maintainer**, users who have that group name become team maintainers for this team. If you select **Member**, users who have this group name become team members. 8. In the **Provider Name** drop-down, select the IdP associated with the mapping. 9. Click **Add**. 10. Click **Save Changes**. The SSO users associated with the group you designated are assigned to the team. ### API Access to Team Group Mappings To access team external IdP group mappings using the Access Management API (for example, `GET /organizations/{orgId}/teams/{teamId}/groupmappings`), have one of these permissions: - **Access Controls Viewer** (`view:access_controls`) - View team group mappings via API - **Access Controls Admin** (`admin:access_controls`) - Create, update, or delete team group mappings via API ## Map SSO Users to Roles You map groups of SSO users to roles in your organization. However, MuleSoft recommends using the Teams feature to manage user permissions. 1. Sign in to Anypoint Platform using an account that has the Organization Administrator permission. 2. Select **Access Management** from the ![gear icon](/mulesoft/current/en-us/access-management/_images/gear.svg) menu. 3. In the Access Management navigation menu, select **Business Groups**. 4. Select the name of the organization to access. 5. Select the **Roles** tab. 6. Click the role you want to modify. 7. Click the **External IdP Groups** tab. 8. In the **Group Names** field, enter one of the following: - SAML: The group attribute that comes from your array of SAML groups - OIDC: The groups claims values that come from the `UserInfo` or `Token` endpoint responses - LDAP: The string from your SAML assertion AttributeValue 9. In the **Provider Name** drop-down, select the IdP associated with the mapping. 10. Click **Add**. 11. Click **Save Changes**. The SSO users associated with the groups you designated are assigned the role. ## See Also - [Teams](https://docs.mulesoft.com/access-management/teams) - [Roles](https://docs.mulesoft.com/access-management/roles) --- product: Access Management version: master --- # Obtaining an API Bearer Token Using a SAML Assertion > For the full documentation index, see: https://docs.mulesoft.com/llms.txt Use a SAML 2.0 IdP-initiated SSO assertion to obtain an API bearer token for Anypoint Platform APIs so federated users within your organization can use the token to access Anypoint Platform APIs. > [!NOTE] Obtaining an API bearer token using a SAML assertion works only for SSO flows that are > initiated from an Identity Provider (IdP). Service provider-initiated SSO doesn’t support > unsolicited assertions. For more information, see > [Initiate the SSO Flow with an Identity Provider](#idp-initiated-sso). The bearer token provides access to the platform APIs a user has permission to access. Each bearer token is associated with a specific user who is granted roles and permissions for an API. If a user attempts to access an API that they do not have permissions to access the API returns a `401 Unauthorized` error. The validity of the bearer token is determined by the value defined for the Default Session Timeout property. This is configured in the root organization properties. See [Manage Root Business Group Settings](https://docs.mulesoft.com/access-management/managing-business-groups#manage-root-org-settings) for more information. ## Initiate the SSO Flow with an IdP To successfully exchange a SAML assertion for an API bearer token, make sure your SSO flow is initiated from the IdP and not the service provider (SP).
SP-Initiated (Standard Login)IdP-Initiated (Assertion Exchange)

Starting point

Anypoint Platform signin page

IdP portal or custom script

InResponseTo

Required

Must be empty

Use case

User signs in on the Anypoint Platform signin page

CLI, scripts, automation

Result

Browser cookie

Bearer token

- Launch Anypoint Platform from your IdP’s portal or use the IdP’s IdP-initiated SSO URL that’s configured for the Anypoint Platform application. - Don’t start the SSO flow from Anypoint Platform URLs such as `/accounts/login`, deep links, or bookmarks to Anypoint Platform services. Those paths won’t produce an assertion that can be exchanged for a bearer token. - Check the `` element to ensure it doesn’t include an `InResponseTo` attribute. IdP-initiated responses are unsolicited and must have an empty `InResponseTo`, for example: ```xml https://idp.example.com ``` If `InResponseTo` is present, the exchange fails with an error similar to: `Unauthorized: IDP-initiated SSO – InResponseTo: must be empty`. ## Obtain an API Bearer Token Using a SAML Assertion Use an IdP-initiated SAML response to obtain an API bearer token for Anypoint Platform. Capture the Base64-encoded SAML response from your IdP and POST it to the Anypoint Platform token endpoint to receive the token. 1. Obtain a SAML response for your identity provider as described in [View a SAML Response in Your Browser](https://docs.mulesoft.com/access-management/troubleshoot-saml-assertions-task). Record this response to use in the following step. 2. Obtain the bearer token by running the following `curl` command. Replace `` in this example with the SAML response you obtained in the previous step. > [!NOTE] The SAML response must be Base64-encoded. If the SAML response string is URL encoded, > you must decode the string before running the `curl` command. curl -X POST \\ https://anypoint.mulesoft.com/accounts/login/:org-domain/providers/:providerId/receive-id \\ -H 'Content-Type: application/json' \\ -H 'X-Requested-With: XMLHttpRequest' \\ -d '{ "SAMLResponse": "" }' After obtaining the bearer token federated users within your organization can use it to access an API. For example, you can access the API using one of the following methods: - **Anypoint CLI**: A user can access a platform API by supplying the `-bearer` option to the `anypoint-cli` command. See [Anypoint CLI](https://docs.mulesoft.com/anypoint-cli/latest/#authentication) for more information. - **curl**: A user can access a platform API by passing the bearer token when accessing an API endpoint as shown in the following: curl -X GET \\ https://anypoint.mulesoft.com/accounts/api/me \\ -H 'Authorization: Bearer ' ## See Also - [Managing Business Groups in Anypoint Platform](https://docs.mulesoft.com/access-management/managing-business-groups) - [Anypoint CLI Overview](https://docs.mulesoft.com/anypoint-cli/latest/) - [View a SAML Response in the Browser](https://docs.mulesoft.com/access-management/troubleshoot-saml-assertions-task) --- product: Access Management version: master --- # Permissions by Product in Anypoint Platform > For the full documentation index, see: https://docs.mulesoft.com/llms.txt Find and assign Anypoint Platform permissions by product for teams and users. Review cross‑product dependencies and where to grant each permission. Make sure users have the exact access required for their roles. Some products require permissions from other products to use them properly. For example, Anypoint Monitoring requires users to have certain Runtime Manager permissions in addition to Anypoint Monitoring-related permissions. See each product’s documentation to determine which permissions your users need and how to set them. Depending on your organization’s licensing and entitlements, not all of these permissions are available during configuration. ## Access Management
Required PermissionsGrants the Ability toNotes

Organization Administrator

  • Perform most Anypoint Platform tasks, including but not limited to secrets management, network administration, and other view, modify, execute, and delete permissions.

  • Access the Organization Administration page.

  • Add and manage users and permissions.

  • View and edit organization details, access API Manager > Client Applications, access the client ID and client secret for the organization, and customize the theme of the Developer Portal.

  • Edit all versions of all APIs, all registered applications, and all API Portals in Anypoint Platform.

For security reasons, assign this permission to as few users as possible.

Audit Log Config Manager

Configure the retention period for audit logs across the organization.

This permission can be added only by an organization administrator at the root organization level.

This permission appears only if the organization has the modern UI enabled in access management.

Audit Log Viewer

View audit logs in Access Management.

## Agent Visualizer
Required PermissionsGrants the Ability toNotes

Anypoint Monitoring: Monitoring Viewer

View monitoring data for agentic assets.

Exchange: Exchange Viewer

View agentic assets.

API Manager: View APIs Configuration

View API nodes and relationships.

API Manager: View Policies

View policies for assets.

## Anypoint Code Builder
Required PermissionsGrants the Ability toNotes

Anypoint Code Builder Developer

Create and use cloud IDE instances of Anypoint Code Builder.

This permission does not apply to Anypoint Code Builder for Desktop.

This permission can be added only by an organization administrator at the root organization level.

Mule Developer Generative AI User

Use natural language prompts to develop and generate flows using generative AI for MuleSoft Vibes.

This permission can be added only by an organization administrator at the root organization level.

## API Catalog
Required PermissionsGrants the Ability toNotes

API Catalog Contributor

Catalog assets and other resources using API Catalog.

## API Experience Hub
Required PermissionsGrants the Ability toNotes

API Experience Hub Admin

View, create, modify, and delete content in API Experience Hub.

API Experience Hub Users Approver

Approve or reject new user access requests and manage existing members' access.

## API Governance
Required PermissionsGrants the Ability toNotes

Governance Administrator

Manage profiles and view reports.

Governance Viewer

View reports.

## API Manager Depending on your organization, you might see one of these sets of permissions available for API Manager.
Table 1. Post-Crowd
Required PermissionsGrants the Ability toNotes

API Manager Environment Administrator

View, create, modify, and delete APIs in the specified environment.

Users can also execute any actions related to API configurations, groups, proxies, alerts, contracts, tiers, policies, automated policies, and other settings in the specified API Manager environment.

API Group Administrator

View, create, modify, deprecate, and delete API groups and API group instances in the specified environment.

Deploy API Proxies

Deploy API proxies in the specified environment.

Manage API Alerts

View, create, modify, and delete API alerts in the specified environment.

Manage APIs Configuration

View and modify API configurations in the specified environment.

Manage Client Applications

Create and manage client applications in the root organization.

Users with this permission can view and modify application credentials and can add and remove client owners.

This permission can be added only by an organization administrator at the root organization level.

Manage Contracts

View, accept, reject, and delete contracts and tiers in the specified environment.

Manage Policies

View, create, modify, and delete API policies in the specified environment.

View API Alerts

View the API alerts in the specified environment.

View APIs Configuration

View API configurations in the specified environment.

View Client Applications

View client applications in the root organization.

This permission can be added only by an organization administrator at the root organization level. Users with this credential can’t view application secrets and can’t modify applications.

View Contracts

View contracts and tiers in the specified environment.

View Policies

View API policies in the specified environment.

Table 2. Pre-Crowd
Required PermissionsGrants the Ability toNotes

API Creator

Create an API in the specified environment.

API Versions Owner

View, modify, delete, and deprecate all API versions in the specified business group.

Portals Viewer

View all portals in the specified business group.

## API Visualizer
Required PermissionsGrants the Ability toNotes

Visualizer Editor

View, create, modify, and delete content in Anypoint Visualizer.

This permission can be added only by an organization administrator at the root organization level.

## Data Gateway
Required PermissionsGrants the Ability toNotes

Data Gateway Administrator

Full access to Data Gateway Designer.

Data Gateway Viewer

Read-only access to Data Gateway Designer.

## DataGraph
Required PermissionsGrants the Ability toNotes

Contribute

  • Add source APIs to the unified schema.

  • Edit any source API schema added to the unified schema.

  • Request access to run queries.

  • Promote API schemas to an environment.

  • View query traces in real-time while running queries from the UI.

  • Download a copy of the unified schema from the query editor.

Consume

  • View and explore the unified schema.

  • Request access to run queries and make data requests from the UI.

  • Download a copy of the unified schema from the query editor.

Operate

  • View customer-facing logs.

  • Set a dedicated load balancer URL for Anypoint Datagraph.

DataGraph Admin

  • Contribute, consume, and operate the unified schema.

  • View usage metrics.

DataGraph Project - Contributor

  • Add source APIs to the unified schema.

  • Edit any source API schema added to the unified schema.

  • Request access to run queries.

  • Promote API schemas to an environment.

  • View query traces in real-time while running queries from the UI.

  • Download a copy of the unified schema from the query editor in a specific project.

DataGraph Project - Operator

View customer-facing logs and set a dedicated load balancer URL for Anypoint Datagraph in a specific project.

DataGraph Project - Admin

  • Contribute, consume, and operate the unified schema.

  • View usage metrics in a specific project.

## Design Center
Required PermissionsGrants the Ability toNotes

Design Center Developer

View, create, and manage all projects within a business group.

Use this permission to set up administrators for all projects within a specific business group.

Design Center Creator

Create projects in Design Center from the navigation panel and view all projects created or shared with the user.

Use this permission to invite users to create, edit, and maintain your projects.

Design Center Viewer

View all Design Center projects within a business group and test projects with the Mocking Service.

Users with this permission can’t create new projects, edit or rename existing projects, or share projects with another user.

Assign this permission to those who consume your project in a specific business group.

### Design Center Project-level Permissions
Required PermissionsGrants the Ability toNotes

Project Administrator

Manage and share a Design Center project within a business group.

Use this permission to set up administrators for all the projects within a specific business group.

Project Editor

Edit a Design Center project within a business group.

Use this permission to invite users to create, edit, and maintain your projects.

Project Viewer

View a Design Center project within a business group and test projects with the Mocking Service.

Users with this permission can’t create a new project, edit or rename the existing project, or share the project with another user.

Assign this permission to those who consume your project in a specific business group.

## Enhanced MuleSoft Experience
Required PermissionsGrants the Ability toNotes

Any of these permissions:

  • Exchange: Exchange Viewer

  • Exchange: Exchange Contributor

  • Exchange: Exchange Administrator

View services

View services in the portfolio and open the catalog overview in Anypoint Exchange.

One of these Exchange permissions:

  • Exchange: Exchange Contributor

  • Exchange: Exchange Administrator

  • Exchange: Exchange Creator

Create services

Register MCP servers, agents, LLMs, or APIs. To create an MCP server, you also need the API Manager: Manage APIs Configuration permission on at least one environment.

API Manager: API Creator

Create instances

Create or add instances.

API Manager: View APIs Configuration

View instances

View instances for services and open the Instances tab.

API Manager: Edit APIs Configuration

Edit instances

Edit instances for services.

Exchange: Exchange Administrator

Create scanners

Create scanners from Providers using Add MCP Server, Add Agent, or Add API if your organization enables matching scanner capabilities.

To view the Providers section, you need these permissions or the required scanner entitlements for API, MCP, or agent scanners.

Any of these permissions:

  • Secrets Manager: View Vault Integrations

  • Secrets Manager: Manage Vault Integrations

View vaults

List and view external vaults under Platform > Providers, including sync activity and health checks.

Secrets Manager: Manage Vault Integrations

Manage vaults

Register, edit, delete, test, and sync external vaults under Platform > Providers. This permission includes View Vault Integrations.

Any of these permissions:

  • Anypoint Monitoring: Monitoring Viewer

  • Anypoint Monitoring: Monitoring Administrator

View monitoring

Open the Monitoring tab at the service and instance levels, and view Monitoring in the navigation bar.

API Manager: View Policies

View policies

View and apply policies on instances, and access policies from the Governance tab.

API Manager: Manage Policies

Apply policies

Edit policy configurations and add policies.

These permissions:

  • API Manager: Manage Policies

  • API Manager: View APIs Configuration

  • API Manager: View Policies

  • Anypoint Monitoring: Monitoring Viewer

  • Exchange: Exchange Viewer

  • Anypoint Code Builder: Mule Developer Generative AI User (Optional)

Use the Cost Management experience

Apply optimization strategies using policies, view policies, view Exchange assets, and query metrics. The Mule Developer Generative AI User permission is required to enable AI features.

Anypoint Code Builder: Mule Developer Generative AI User

Use AI features in Anypoint Code Builder

Use AI-powered features in Anypoint Code Builder, including MuleSoft Vibes and Diagnostics Agent.

Any of these permissions:

  • API Governance: Governance Administrator

  • API Manager: Manage Policies

Create governance strategies

Create governance strategies.

To view and create governance strategies, you need the Governance Administrator permission for Control types, or the Manage Policies permission for Automated Policy types.

Any of these permissions:

  • API Governance: Governance Viewer

  • API Governance: Governance Administrator

View governance reports

View governance reports at the service and governance strategy levels.

To see the conformance badge and whether rulesets passed or failed, you need the Exchange Viewer permission. To view or export detailed governance reports, including violations, warnings, and rule breakdowns, you need the Governance Viewer permission.

Any of these permissions:

  • API Manager: View API Alerts

  • Runtime Manager: Read Alerts

View alerts

View API alerts in API Manager and read alerts in Runtime Manager.

Any of these permissions:

  • API Manager: Manage API Alerts

  • Runtime Manager: Manage Alerts

Manage alerts

Manage API alerts in API Manager and alerts in Runtime Manager.

MuleSoft Agent AI User

Use MuleSoft Agent functionality

Access MuleSoft Agent functionality in the enhanced experience.

## Exchange
Required PermissionsGrants the Ability toNotes

Exchange Administrator

  • View, create, and download assets within a business group.

  • Edit asset portal content in an existing asset version.

Users with this permission have the same access as users with the Exchange contributor and Exchange viewer permissions, and access to share an asset with another user, deprecate an asset, and delete an asset.

Use this permission to set up Exchange administrators for all assets within a specific business group.

Exchange Contributor

View, create, and download assets within a business group.

Users with this permission can edit asset portal content in an existing asset version.

Use this permission to invite users to edit and maintain your asset portal descriptions.

Exchange Viewer

View and download assets within a business group.

Users with this permission can’t add new assets, edit asset portal content, or share an asset with another user.

Assign this permission to those who consume your assets in a specific business group.

Exchange Creator

Create new assets within a business group’s catalog.

A user with this permission can’t modify assets or asset versions created by other users in the business group.

Once the users with this permission create an asset, the Asset Administrator permission is automatically assigned for the assets they create. The Asset Administrator permission allows these users to modify only the assets that they create.

Use this permission to restrict the modification of assets except for assets created by this user while allowing all developers across all teams in a business group to create new assets in Exchange.

Asset Viewer

View and download an asset.

Users with this permission can’t edit asset portal content or share an asset with another user.

Use this permission to invite a user outside your business group to view and download an asset.

Asset Contributor

View, add a new version, and download an asset.

Use this permission to invite a user outside of your business group to view, download, and add edit portal content for an asset.

Asset Administrator

View, create, download, deprecate, and delete an asset.

Users with this permission have the same access as users with the Exchange Administrator permission, but on only a single asset. This permission is assigned by default to an asset creator.

Use this permission to extend administrator permissions for an asset to an additional user.

Generate Asset Documentation with AI

Generates documentation for existing asset versions within a business group using generative AI features.

## IDP
Required PermissionsGrants the Ability toNotes

Manage Actions

Complete access to IDP and assigns reviewer permission by default for every document action.

Build Actions

Create, edit, and publish document actions and assign reviewers to the actions.

Execute Published Actions

Execute a published document action and retrieve the results of the execution.

Configure Connected Apps

Configure a connected app to communicate with IDP.

## Monitoring
Required PermissionsGrants the Ability toNotes

Monitoring Administrator

View, create, modify, and delete content in Anypoint Monitoring.

 

Monitoring Viewer

View but not modify content in Anypoint Monitoring.

 

Telemetry Exporter Administrator

  • View connections and configurations in Telemetry Exporter.

  • Create, modify, and delete connections in Telemetry Exporter.

  • Create, modify, and delete configurations in Telemetry Exporter.

Assign this permission at the root organization level.

Availability of this permission depends on your organization’s subscription tier.

Telemetry Exporter Configurations Manager

  • View connections and configurations in Telemetry Exporter.

  • Create, modify, and delete configurations in Telemetry Exporter.

Availability of this permission depends on your organization’s subscription tier.

## MQ
Required PermissionsGrants the Ability toNotes

View clients

View all client apps, including client app IDs and client secrets for each client app.

View destinations

  • View all destinations and each destination’s settings (ID, Type, Message TTL, and Message Lock Default TTL).

  • View In Queue message stats.

  • View In Flight message stats.

Clear destinations

  • View all destinations and each destination’s settings (ID, Type, Message TTL, and Message Lock Default TTL).

  • View In Queue message stats.

  • View In Flight message stats.

Manage clients

  • View all client apps, including client app IDs and client secrets for each client app.

  • Create client apps.

Administer destinations

  • View all destinations and each destination’s settings (ID, Type, Message TTL, and Message Lock Default TTL).

  • View In Queue message stats.

  • View In Flight message stats.

    • Create new queues, message exchanges, and bindings.

    • Edit existing queues, message exchanges, and bindings.

    • Purge messages from queues.

Manage destinations (deprecated)

  • View all destinations and each destination’s settings (ID, Type, Message TTL, and Message Lock Default TTL).

  • View In Queue message stats.

  • View In Flight message stats.

  • Create new queues and message exchanges.

  • Edit existing queues and message exchange settings.

  • Access Message Sender and Browser pages.

  • Delete messages.

  • Purge messages from queues.

This permission is deprecated. Assign these permissions instead:

  • Administer destinations

  • Destination subscriber for a given environment

  • Destination publisher for a given environment

Destination subscriber for a given environment

  • Consume messages from a destination.

  • Delete messages from a destination.

Destination publisher for a given environment

  • Send messages to a destination.

  • Update message TTL on a destination.

Read MQ stats

View organization and environment statistics.

## Object Store v2
Required PermissionsGrants the Ability toNotes

Manage stores

Create, read, update, and delete stores.

Manage stores data

Perform all store operations including data, partition, and confirmation APIs.

View stores

Read store details.

Manage store clients

Manage all clients of a cloud store.

This permission doesn’t apply to Object Store v2.

View store clients (object store only)

View all clients of a cloud store.

This permission doesn’t apply to Object Store v2.

## Partner Manager
Required PermissionsGrants the Ability toNotes

Partner Manager Administrator

Have complete access to the host, partner, message flow configurations, and transaction activity.

View Host, Partners and Message Flows

Have view-only access to the host, partner, and message flow configurations.

This user can’t view transaction activity.

Manage Partners and Message Flows

  • Create, modify, and delete partners or message flow configurations.

  • View partner configurations.

This user can’t view and manage transaction activity.

Manage Activity

View and manage transaction activity.

This user can’t view or modify either partner or message flow configurations.

Manage Host

Create, modify, and delete host configurations.

This user can’t view or modify partner configurations or transaction activity. This access applies even if the user has the Organization Administrator permission.

View Activity

Have view-only access to transaction activity.

This user can’t view or modify either partner or message flow configurations.

## RPA
Required PermissionsGrants the Ability toNotes

RPA Administrator

Perform all tasks, except those provided by the RPA Project Manager permission.

A user with this permission can only view or administer automation projects if the user is part of the process team.

RPA Automations Designer

RPA developer, citizen technologist, or knowledge source (such as a business analyst or process owner):

In RPA Manager:

  • Create automation projects.

  • Record or design models of business processes that a process manager or center of excellence approved for automation.

  • Document and edit the applications required for performing the processes.

Replaces these permissions

  • Application Create

  • Application Edit

  • Process Automation Open

  • Process Create

  • Process Recording

RPA Automations Contributor

RPA developer, citizen technologist, or knowledge source (such as a business analyst or process owner):

  • In RPA Manager:

    • Create automation projects.

    • Record or design models of business processes that a process manager or center of excellence approved for automation.

    • Document and edit the applications required for performing the processes.

    • Create and edit global variables to link to activity parameters created with RPA Builder.

  • In RPA Builder:

    • Build the automation based on the model.

    • Reuse activities from the Activity Library.

Replaces these permissions

  • Activity Library Open

  • Application Create

  • Application Edit

  • Builder Usage

  • Global Variables Create for Productionphase

  • Global Variables Create for Testphase

  • Global Variables Edit for Productionphase

  • Global Variables Edit for Testphase

  • Process Automation Open

  • Process Create

  • Process Recording

RPA Automations Manager

RPA developer, citizen technologist, or knowledge source (such as a business analyst or process owner):

  • In RPA Manager:

    • Create automation projects.

    • Record or design models of business processes that a process manager or center of excellence approved for automation.

    • Document and manage the applications required for performing the processes.

    • Create and manage global variables to link to activity parameters created with RPA Builder.

    • Change the owners and managers of processes.

    • Reassign unprocessed user tasks

  • In RPA Builder:

    • Build the automation based on the model.

    • Reuse and manage activities from the Activity Library.

Replaces these permissions

  • Activity Library Administration

  • Activity Library Open

  • Application Create

  • Application Delete

  • Application Edit

  • Builder Usage

  • Change Process Owner

  • Change Project Manager

  • Global Variables Create for Productionphase

  • Global Variables Create for Testphase

  • Global Variables Edit for Productionphase

  • Global Variables Edit for Testphase

  • Global Variables Delete

  • Process Automation Open

  • Process Create

  • Process Recording

  • Unprocessed Task List Edit

  • Unprocessed Task List Open

RPA Bots Manager

In RPA Manager:

  • Monitor and manage all RPA Bots, including:

    • Manage service times.

    • View session queues.

  • Manage the applications required for performing the processes, including downtimes.

Replaces these permissions

  • Application Create

  • Application Delete

  • Application Edit

  • Process Monitoring Open

  • Robot Management Administration

  • Robot Management Open

  • Robot State and Operation Open

  • Service Time Create

  • Service Time Delete

  • Service Time Edit

RPA Evaluations Viewer

In RPA Manager:

  • View all process evaluations, regardless of whether the user belongs to the process team.

  • View:

    • Evaluation criteria

    • Evaluation templates

Replaces these permissions

  • Evaluation Criteria Open

  • Evaluation Templates Open

  • Global Process Evaluation View

  • Process Evaluation Open

RPA Evaluations Contributor

In RPA Manager:

  • View all process evaluations, regardless of whether the user belongs to the process team.

  • View, create, and edit:

    • Evaluation criteria

    • Evaluation templates

  • View, create, edit, and delete process evaluations.

Replaces these permissions

  • Evaluation Criteria Create

  • Evaluation Criteria Edit

  • Evaluation Criteria Open

  • Evaluation Templates Create

  • Evaluation Templates Edit

  • Evaluation Templates Open

  • Global Process Evaluation View

  • Process Evaluation Administration

  • Process Evaluation Open

RPA Evaluations Manager

In RPA Manager:

  • View all process evaluations, regardless of whether the user belongs to the process team.

  • View, create, edit, and delete:

    • Evaluation criteria

    • Evaluation templates

  • Process evaluations

  • Approve evaluated processes to a center of excellence or a project manager for automation.

Replaces these permissions

  • Evaluation Criteria Create

  • Evaluation Criteria Delete

  • Evaluation Criteria Edit

  • Evaluation Criteria Open

  • Evaluation Templates Create

  • Evaluation Templates Delete

  • Evaluation Templates Edit

  • Evaluation Templates Open

  • Global Process Evaluation View

  • Process Evaluation Administration

  • Process Evaluation Approval to a CoE

  • Process Evaluation Approval to a Project manager

  • Process Evaluation Open

RPA Operations Viewer

In RPA Manager:

  • View all aspects of these RPA assets:

    • Alerts

    • Bots

    • Dashboards

  • View this information for processes for which the user belongs to the process team:

    • Deployment maps

    • Execution plans

    • Session queues

  • Watch the bot at work via process streaming.

Replaces these permissions

  • Alerting Open

  • Dashboard Open

  • Process Deployment Map Open

  • Process Execution Plans Open

  • Process Monitoring Open

  • Process Streaming Open

  • Robot Management Open

  • Robot State and Operation Open

RPA Operations Manager

In RPA Manager:

  • View and manage these RPA assets:

    • Alerts

    • Bots

    • Dashboards

    • Unprocessed user tasks

    • Upcoming process changes

  • Analyze finance aspects and billing reports

  • View this information for processes for which the user belongs to the process team:

    • Deployment maps

    • Execution plans

    • Session queues

  • Watch the bot at work via process streaming.

Replaces these permissions

  • Alerting Administration

  • Alerting Open

  • Dashboard Open

  • Process Deployment Map Open

  • Process Execution Plans Open

  • Process Monitoring Open

  • Process Streaming Open

  • Robot Management Open

  • Robot State and Operation Open

  • Billing Report Open

  • Dashboard Administration

  • Finance Analysis Edit

  • Finance Analysis Open

  • Global Finance Analysis View

  • Global Process Execution Plans View

  • Unprocessed Task List Edit

  • Unprocessed Task List Open

  • Upcoming Process Changes Administration

  • Upcoming Process Changes Open

RPA Performance Analyzer

In RPA Manager:

  • Analyze the financial aspects (such as the break-even point) of all processes.

  • View the billing reports.

Replaces these permissions

  • Billing Report Open

  • Finance Analysis Edit

  • Finance Analysis Open

  • Global Finance Analysis View

RPA Project Manager

Be assigned as a project manager of automation projects in RPA Manager. For a user to function as a project manager, the user must also have one of these permissions:

  • RPA Automations Designer

  • RPA Automations Contributor

  • RPA Automations Manager

  • RPA Administrator

Replaces the RPA Project Management permissions.

## Runtime Manager
Required PermissionsGrants the Ability toNotes

CloudHub Network Administrator

Manage CloudHub and CloudHub 2.0 network resources.

CloudHub Network Viewer

View CloudHub and CloudHub 2.0 network resources.

Delete Applications

Delete applications in a specific environment.

Download Applications

Download application files in a specific environment.

Manage Alerts

Create, update, and delete application alerts in a specific environment.

Manage Application Data

Create and delete application data in a specific environment.

Manage Queues

Clear application queues in a specific environment.

Read Runtime Fabric

Query Runtime Fabric instances in the organization.

Manage Runtime Fabrics

read, create, update, and delete Runtime Fabric resources.

Manage Runtime Fabric

Read, create, update, and delete Runtime Fabric resources.

Manage Schedules

Run and update application schedules in a specific environment.

Manage Settings

Update application settings in a specific environment.

Manage Tenants

Create, update, and delete application tenants in a specific environment.

Read Alerts

View alerts in a specific environment.

Read Applications

View applications in a specific environment.

Manage Servers

Create, update, and delete server and Omni Gateway resources.

Read Servers

View server and Omni Gateway resources.

Manage Application Flows

Update flows.

Create Applications

Create applications in a specific environment.

Restart Applications

Restart applications deployed to Runtime Fabric in a specific environment.

## Secrets Manager
Required PermissionsGrants the Ability toNotes

Grant access to secrets

Browse, read metadata and grant access to secrets in a specific environment.

Manage secret groups

  • Create, modify, delete, read, and clone secret groups in a specific environment.

  • Check if the user can initiate a new clone or restore operation.

Read secrets metadata

Browse and read metadata of secrets in a specific environment.

Write secrets

Upload, create, modify secrets in a specific environment.

View Vault Integrations

List and view external vault integrations and their sync activity and health checks in a specific environment.

This permission applies only to the enhanced experience.

Manage Vault Integrations

Create, edit, delete, test, and sync external vault integrations in a specific environment. Extends the View Vault Integrations permission.

This permission applies only to the enhanced experience.

## Tokenization
Required PermissionsGrants the Ability toNotes

Manage Tokenization Services

View, create, edit, and delete tokenization resources.

Manage Tokenization Formats

View, create, edit, and delete tokenization formats.

## Usage
Required PermissionsGrants the Ability toNotes

Usage Viewer

View usage reports.

This permission can be added only by an organization administrator at the root organization level.

--- product: Access Management version: master keywords: anypoint platform, permissions, configuring, accounts, roles --- # Permissions in Anypoint Platform > For the full documentation index, see: https://docs.mulesoft.com/llms.txt Use permissions to control user access to resources in your Anypoint Platform organization. Assign permissions through teams or roles to manage access for groups of users, or grant permissions directly to individual users across products, environments, and business groups. To manage permissions, you need the Organization Administrator permission for your organization or one of its business groups, or the API Version Owner permission for a specific API version, business group, or the entire organization. ## How Permissions Work in Anypoint Platform In Anypoint Platform, users belong to organizations (business groups) and have sets of permissions. Assign permissions through [teams](https://docs.mulesoft.com/access-management/teams), [roles](https://docs.mulesoft.com/access-management/roles), or [direct user grants](https://docs.mulesoft.com/access-management/users#grant-user-permissions). Use teams to create groups of users and assign permissions across multiple business groups. As an Organization Administrator, create and modify teams and assign cascading permissions according to your organization’s structure. Each role contains a list of permissions that define what a user can do with specific resources within the role’s scope. Certain roles include a set of default permissions. As an Organization Administrator, create custom roles and assign the permissions you need. Depending on the product, grant permissions directly to a specific user without roles or teams. ### Permission Types Depending on which products you have in Anypoint Platform, every new organization, team, and business group receives a set of default permissions when created: - **Product Permissions** Default permissions for each Anypoint Platform product (Runtime Manager, Omni Gateway, Exchange, and so on) are environment-specific, granting users access within a particular environment but not across the entire organization. Assign these default permissions to teams, custom roles, or CloudHub roles. - **API Permissions** API permissions vary depending on which API Manager version you use. - **Permissions in API Manager 1.x** - Default permissions for each API managed from Anypoint Platform are either specific to an API version or extended to all versions. Manage user access based on a particular API version, but you can’t extend those permissions to the entire organization. To grant user permissions to all APIs, add them to teams that have the API Versions Owner and Portals Owner permissions. - Assign user permissions to edit or view individual API versions or API portals using the **API Version Owner** and **Portal Viewer** permissions. > [!NOTE] These two API permissions grant the same permissions as the API Versions Owner and > Portals Viewer roles, but they’re limited to the API and version that you specify. For more > information about these scopes, see [Roles](https://docs.mulesoft.com/access-management/roles#permission-scopes-for-default-roles). - **Permissions in API Manager 2.x** - Default permissions for each API managed from API Manager grant permission to access a specific environment and a specific resource (policies, alerts, and so on). When you grant a user permission to an environment, the user gets access to that environment immediately. For example, to grant a user permission to create and edit alerts, assign them the **Manage Alerts** permission. - To create an API in Exchange, users need either the Exchange Admin permission or Exchange Contributor permission. API versions and product deployment environments are grouped under organizations and optionally under business groups. A user account with the necessary permissions for the corresponding organization or business group is required to access them. Roles assigned at the root organization level can reference only resources at the root organization level, and roles that belong to a business group can reference only resources within that business group. > [!NOTE] A user who has any role in a business group implicitly receives membership in that > business group. To assign permissions to the same user in a different business group, assign them > a role within that second business group. ## See Also - [Using Teams to Manage User Permissions](https://docs.mulesoft.com/access-management/teams) - [Using Roles to Manage Permissions](https://docs.mulesoft.com/access-management/roles) - [Managing Users](https://docs.mulesoft.com/access-management/users) - [Permissions by Product in Anypoint Platform](https://docs.mulesoft.com/access-management/permissions-by-product) --- product: Access Management version: master --- # Private Cloud Edition Features > For the full documentation index, see: https://docs.mulesoft.com/llms.txt Anypoint Platform Private Cloud Edition enables you to: 1. Configure [User Management](https://docs.mulesoft.com/access-management/external-identity#user-management) using [LDAP](https://docs.mulesoft.com/access-management/external-identity#configure-ldap). 2. Configure an [SMTP server](#smtp) to send API Manager alerts from your Anypoint Platform Private Cloud Edition installation. 3. Set your [certificates and private key](#security) to handle SSL encryption for Anypoint Platform. 4. Add a customized [disclaimer](#disclaimer) to the Anypoint Platform Signin page. ## SMTP Anypoint Platform Private Cloud Edition requires you to set up your own SMTP email server to deliver email alerts for both **API Manager** and **Runtime manager**. > [!NOTE] This service doesn’t create an SMTP server for you. You must configure the service with > the settings of an existing SMTP server within your environment. 1. In the Access Management navigation menu, click the **SMTP** option and configure the details for your SMTP server:
FieldDescriptionExample

Host

The host name of your SMTP server

smtp.gmail.com

Port

The port used to communicate to your SMTP server

587

Username

The username to authenticate to your SMTP server

mulesoft.onprem.smtp@gmail.com

Password

Your SMTP password

examplepassphrase

2. After you enter your configuration information, click **Save**. ## DNS or IP You must provide the DNS or IP that is exposed on your instance of the Anypoint Platform to the local network, to enable Mule runtime to communicate with it. 1. In the Access Management navigation menu, select the **DNS/IP** tab. 2. In the **Platform DNS/IP** field, enter the address where you are hosting Anypoint Platform. 3. Click **Save**. ## Security You can configure Anypoint Platform to use your own certificate, and you can also choose the cipher and DH groups for the key exchange method. 1. In the Access Management navigation menu, click the **Security** link. ![A form with fields to upload a certificate and a private key, a checkbox to use default ciphers and DH group, and a Save button](/mulesoft/current/en-us/access-management/_images/on-prem-features-5f98d.png) 2. In the **Certificate** field, click **Browse** to locate and select your certificate. 3. In the **Key** field, click **Browse** to locate and select the private key for the certificate you provided. 4. Click **Save**. 5. Optionally, you can disregard the default configuration and choose your own cipher and Diffie-Hellman group file. ![A form with fields for a certificate, private key, ciphers, and DH group](/mulesoft/current/en-us/access-management/_images/on-premises-features-3120e.png) 6. Deselect **Use default ciphers and DH Group**. 1. Enter the cipher you want to use, for example, `ECDHE-RSA-AES128-SHA256`. 2. Upload a DH Group. ## Set up a Disclaimer Message 1. Click the **Disclaimer** section to set up a disclaimer message that your users see when they access the Anypoint Platform Signin page. This can also be a custom HTML message. 2. Click **Save**. --- product: Access Management version: master --- # Salesforce Organization Connections in Anypoint Platform > For the full documentation index, see: https://docs.mulesoft.com/llms.txt Enable cross-platform features between your Anypoint Platform organization and a trusted Salesforce organization (tenant) by establishing a connection between them. After you establish a tenant relationship between your Anypoint Platform organization and a Salesforce organization, users in your organization can: - Enable API Catalog to view and sync MuleSoft APIs and MCP servers available in the connected Salesforce organization. - Enable generative AI capabilities in Anypoint Code Builder, Anypoint Exchange, and Intelligent Document Processing (IDP). - Enable MuleSoft Direct so Salesforce administrators can discover and deploy pre-built integrations directly from the connected Salesforce organization. - Enable Integration Intelligence to use AI-powered insights for monitoring, analysis, and troubleshooting of MuleSoft integrations. When you establish the tenant relationship, you can initiate, complete, and manage the tenant relationships. You can also enable, disable, and remove connections. You can establish relationships with multiple Salesforce orgs in your Anypoint Platform organization, but a Salesforce organization can connect to only one Anypoint Platform organization. ## Anypoint Platform Administrators Anypoint Platform organization administrators can: - Initiate the connection process to a Salesforce organization. - Enable a tenant relationship with Salesforce. - Remove the relationship between Anypoint Platform and a Salesforce organization. - Manage connected Salesforce organizations. ## Salesforce Organization Administrators Salesforce admins can: - Complete the connection process to the Anypoint Platform organization. - Disconnect or reconnect an Anypoint Platform and Salesforce organization. - Remove the connection between the Anypoint Platform organization and the Salesforce organization. - Enable the connected Anypoint Platform organization to use the Salesforce organization’s Einstein generative AI capability. For more information about initiating and maintaining a relationship with a Salesforce organization, see [Manage Your MuleSoft Anypoint Platform Connections](https://help.salesforce.com/s/articleView?id=platform.mulesoft_manage_your_anypoint_platform_connection.htm&type=5) in Salesforce Help. ## See Also - [Connecting a Trusted Salesforce Organization to Anypoint Platform](https://docs.mulesoft.com/access-management/connecting-salesforce-orgs) - [Managing Connected Salesforce Orgs](https://docs.mulesoft.com/access-management/managing-connected-salesforce-orgs) - [Enable or Disable Capabilities for a Connected Salesforce Organization](https://docs.mulesoft.com/access-management/manage-capabilities) --- product: Access Management version: master --- # SSO Prerequisites and Limitations > For the full documentation index, see: https://docs.mulesoft.com/llms.txt When using SSO within Anypoint Platform, there are some prerequisites and limitations to be aware of. ## Before You Begin Before using SSO, ensure that you have performed the following: - Configure your identity provider to send the username and email in your assertion. - Configure Anypoint Platform to map the username and email to the expected attribute name. If you don’t configure this setting, signin fails with a 403 unauthorized error message. - Configure the SAML assertion of the identity provider as signed and optionally encrypted using - either **AES128** or **AES256** block encryption algorithm, - **RSA-OAEP (including MGF1 with SHA1)** key transport algorithm, and - **Anypoint Platform Signing Certificate** which can be downloaded from the **SAML 2.0** SSO page. After you configure the SAML assertion for the identity provider, the identity provider issues the SAML assertion as an XML file, which is sent through HTTP as a POST request. ## Client Considerations Be aware of the following considerations related to client behavior: - User accounts created before configuring your federated organization remain within the organization. However, users can only sign in through the Anypoint Platform signin page. They can’t sign in from the redirected signin page of the identity provider. - Existing non-federated users can continue to work normally with the following exceptions: - If a user session times out, the user is redirected to the federated identity signin page instead of the generic one. Links and bookmarks that identify the organization redirect the user to the federated signin page, which fails for non-federated users. - If you configure your identity provider to handle user-information assertion, users must sign in to Anypoint Platform using the URL: https://anypoint.mulesoft.com/accounts/login/{your\_org\_domain} ## Limitations - OpenID Connect does not support single signout. - If a SAML user belongs to certain groups, Anypoint Platform doesn’t automatically grant equivalent permissions in the organization. - Anypoint Platform doesn’t generate the SAML assertion for single sign on. Your IdP generates the sign-on URL that you configure. - External identity configuration is available only at the organization level. You can’t configure an external identity provider for a business group. - If you delete a user from your identity provider, you must also manually delete the user from your Anypoint Platform organization. - If you delete a SAML identity provider and recreate one with the same configuration, it’s considered a new identity provider. Users signing in to Anypoint Platform using this configuration are associated with the new identity provider. If existing user accounts are still associated with the deleted IdP, duplicate users appear because they are associated with a different IdP. --- product: Access Management version: master --- # To Test External Identity > For the full documentation index, see: https://docs.mulesoft.com/llms.txt After configuring your organization’s external identity provider, test the integration. Obtain your organization’s signin URL, for example: `https:/anypoint.mulesoft.com/accounts/login/{organization-domain-name}` by following these steps: 1. Sign in to Anypoint Platform using an account that has the Organization Administrator permission. 2. Select **Access Management** from the ![gear icon](/mulesoft/current/en-us/access-management/_images/gear.svg) menu. 3. In the Access Management navigation menu, click **Business Groups**. 4. Click the name of your root organization. 5. Click the **Settings** tab. 6. Copy your organization name from the Domain Name field. 7. Sign out of your Organization Administrator account in Anypoint Platform. 8. Navigate to your organization’s signin URL. You are redirected to your identity provider. 9. Sign in to your identity provider with a test user managed by your identity provider. After authenticating, you are redirected back to Anypoint Platform as an authenticated user. --- product: Access Management version: master --- # Troubleshoot Access Management > For the full documentation index, see: https://docs.mulesoft.com/llms.txt These tips provide information on what to do if you encounter issues. ## Problems with Accessing Anypoint Platform ### Signin Credentials are Not Recognized If your credentials aren’t recognized when you sign in to Anypoint Platform, try the following: - Check that you are using the correct URL to sign in to your organization. If your organization uses an external identity management system, your signin URL is **anypoint.mulesoft.com/accounts/login/_yourOrganizationDomain_**. - Verify that you are using the correct username and password for the account. - If your organization isn’t using an external identity management system and your signin credentials aren’t working, reset your password or ask your Organization Administrator if your account is still active. ### Access Management Invitation Link Returns an Error If you click the link in your invitation and an error is returned, your invitation may have expired or been rescinded. Please contact your Organization Administrator for a new invitation. If your organization has no other active users who can resend the invitation, see [Invitation, Welcome, and License Key Emails](https://docs.mulesoft.com/access-management/users#invitation-welcome-license-emails). ### Administrative Access Lost To avoid losing administrator access, assign the Organization Administrator permission to more than one user. If you do lose administrator access, for example, if all Anypoint Platform administrators have left the company, are unknown, or have deactivated or deleted accounts, you must contact MuleSoft Support to regain access. 1. Log in to the [MuleSoft Support Portal](https://www.mulesoft.com/support-and-services) and request the organization reclamation process. 2. You must provide: - A signed letter on company letterhead from a C-level executive that requests the administrator change. - Your company details, such as your company name and Anypoint Platform organization name or ID. - Information about the previous administrators, such as their names and email addresses. - The name and email address of the new administrator. ## OpenID Connect Client Management ### Error received when you try to update a client application If you receive an `There was an error while talking to CoreServices` when you try to update a client application under OpenID Connect management, this is because updates of clients created through this integration are not currently supported. See [Configure OpenID Connect Client Management](https://docs.mulesoft.com/access-management/configure-client-management-openid-task) ### Error Received When Doing a Redirect When a redirect to the OpenID Connect Provider occurs, you receive an `Invalid Scopes error`. Cause: This can happen if the `openid`, `profile`, and `email` scopes aren’t supported by the auto-registered client. Solution: Add the `openid`, `profile`, and `email` scopes to the client manually. ## See Also - [Known Issues](https://help.salesforce.com/s/issues) --- product: Access Management version: master --- # Update Your User Profile > For the full documentation index, see: https://docs.mulesoft.com/llms.txt When you sign in to the configured IdP for the first time, an Anypoint user is created using your IdP information. Your user profile includes a username, your name, and email address. Typically, the OpenID Connect `userinfo` endpoint provides a `preferred_username` claim that contains the authenticated user’s username. However, some IdPs such as OpenAM and PingFederate do not support the `preferred_username` claim. Therefore, when Anypoint Platform creates a user, the `email` and `sub` claim values comprise the username if the `preferred_username` claim isn’t present. Claims are made in the following order: `preferred_username`, `email`, `sub`. If a username is created as a single string of random characters and does not have an email address defined, the string may be returning the `sub` claim that the `id` token and `userinfo` endpoint show for the user. To update user profile information from your configured IdP, sign in to Anypoint Platform through the IdP. When you sign in, your user profile is automatically updated with the information from the IdP. --- product: Access Management version: master --- # Using Roles to Manage Permissions > For the full documentation index, see: https://docs.mulesoft.com/llms.txt A _role_ is a set of predefined permissions controlling access to each product or feature within Anypoint Platform. Depending on the product, you can use predefined roles with standard permissions, or you can specify your own permissions for each role. Roles are set only for individual users. Use the [Teams feature](https://docs.mulesoft.com/access-management/teams) for an access solution that works across business groups. To manage roles and permissions within Anypoint Platform, you must have the Organization Administrator permission. To manage user permissions for an API version, you must have the API Versions Owner permission. Anypoint Platform provides two types of roles: - **Default roles**: Roles that are created automatically when an organization or business group is created. These roles provide permissions and access to core functionality of Anypoint Platform. You can assign users to default roles, but you can’t delete default roles. - **Custom roles**: You can create and delete custom roles. You can assign users and add permissions to a custom role, as well as associate a custom role with specific Anypoint Platform products. For example, you can create a custom role called "Application Designer" and then grant Design Center permissions to the role so users assigned the Application Designer role can access Design Center. Roles are business group specific, so make sure you’re in the correct business group when managing roles by clicking the menu next to your username. ## Access Roles 1. Sign in to Anypoint Platform using an account that has the Organization Administrator permission. 2. Select **Access Management** from the ![gear icon](/mulesoft/current/en-us/access-management/_images/gear.svg) menu. 3. In the Access Management navigation menu, select **Business Groups**. 4. Select the name of the organization to access. 5. Select the **Roles** tab. ## Default Roles Default roles are automatically created as part of an organization. Each default role in Anypoint Platform contains a set of pre-defined permissions and scope of actions that enable the user to perform specific actions within the platform. For more information on permissions in Anypoint Platform, see [Managing Permissions](https://docs.mulesoft.com/access-management/managing-permissions). ### Default Roles and Permission Scopes - **API Creators**: Enables a user to create and manage an API in Anypoint Platform. Members of the API Creator role can add new APIs to the platform on the API administration page. This role doesn’t grant privileges for Runtime Manager. This role has the following permission scopes: - Create/Import an API - **API Versions Owner**: Enables a user to manage, delete, and deprecate any API in the organization. They can edit the portal of any API in the organization. However, this role doesn’t enable a user to create a new version of an existing API. This role has the following permission scopes: - Manage any API Version in the organization - Delete any API Version in the organization - Deprecate any API Version in the organization - Edit the Portal of any API version in the organization - **Audit Log Viewers**: Enables a user to access the UI for the Audit Log under Access Management. This role has the following permission scopes: - Visualize logs in the [Audit Logs](https://docs.mulesoft.com/access-management/audit-logging) section. - **CloudHub Admin**: Provides access to all Runtime Manager functionality. This role has the following permission scopes: - Create Applications - Delete Applications - Download Applications - Manage Alerts - Manage Application Data - Manage Queues - Manage Schedules - Manage Servers - Manage Settings - Read Applications When you create an environment under a business group, Anypoint Platform automatically creates a **CloudHub Admin ()** role for that environment. All users with the Organization Administrator permission on that business group are automatically added to this role. To remove users from this role, go to **Access Management** > **Business Groups** > **Roles** after creating the environment. - **CloudHub Developer**: **(Deprecated)** Provides access to all Runtime Manager functionality, except organization and billing settings. This role has the following permission scopes: - Create Applications - Download Applications - Manage Alerts - Manage Application Data - Manage Queues - Manage Schedules - Manage Settings - Read Applications - Read Servers - **CloudHub Support**: **(Deprecated)** Provides read-only access to dashboards, notifications, alerts, logs, and their user settings. This role has the following permission scopes: - Read Applications - **Organization Administrators**: Enables a user to edit all versions of all APIs, all registered applications, and all API Portals in Anypoint Platform. Access to the Organization Administration page, where the user can add and manage users and roles, view and edit organization details, access **API Manager > Client Applications**, access the client ID and client secret for the organization, and customize the theme of the Developer Portal. Members of the Organization Administrators role also inherit the role of **API Creator** by default. This role has the following permission scopes: - Edit developer portal theme settings - Request API access terms and conditions - Edit portal terms and conditions - Set custom policies - Manage access of third-party applications to an API (specific to the organization administrator of the root business group) - Edit users' email addresses - Grant VPC and CloudHub dedicated load balancer permissions - **Exchange Administrators**: Enables a user to manage Exchange Portals, including customization, manage assets, manage reviews. This role has the following permission scopes: - Create content - Manage assets - Publish, delete, and deprecate content - Manage public visibility of assets - Customize Exchange portal - **Exchange Contributors**: This role has the following permission scopes: - Create content - Manage own content, including the ability to add a new version and edit your own version content, but you can’t delete your own version. - Manage own reviews, including the ability to add, edit, and delete - **Exchange Viewers**: Enables a user to view and consume Exchange assets. This role has the following permission scopes: - View and consume Exchange assets - Manage own reviews, including the ability to add, edit, and delete - **Portals Viewer**: (Deprecated in API Manager 2.0) The ability to view an API Portal doesn’t automatically give a user access to the API. You can’t grant Portal Viewer permissions unless the API has an API Portal. Users with this role can view API Portals from the Developer Portal, including private API portals where they have Portal Viewer permissions. > [!NOTE] If you’re using API Manager 2.0, users with the Portals Viewer role aren’t able to view > private APIs. For API Manager 2.0, assign the user at least the Exchange Viewers role to allow the > user access to all Exchange assets within the business group where you assigned the permission. > To control access for a single private API, don’t assign the Exchange Viewers role to the user for > the business group where the private API resides. Instead, use the share asset feature in > Exchange. See [Share an Asset](https://docs.mulesoft.com/exchange/to-share-an-asset). Only users with the Exchange > Administrators role can share an asset with another user. ### Add Users to a Default Role To add a user to a role, the user must belong to the same business group as the role. 1. Sign in to Anypoint Platform. 2. Select **Access Management** from the ![gear icon](/mulesoft/current/en-us/access-management/_images/gear.svg) menu. 3. In the Access Management navigation menu, select **Business Groups**. 4. Select the name of the organization to access. 5. Select the **Roles** tab. 6. Click the name of the default role. Default roles don’t have a radial button next to them. 7. Enter the user’s name in the search box. 8. Select the user from the drop-down list of results, then click the blue plus sign on the right of the search box. 9. To change the role’s description: 1. Click the description. The description changes to an editable field. 2. Enter the new description for the role, then press `Enter`. > [!NOTE] When editing role names and descriptions, use the 'Enter' key to save changes. Clicking > outside the text box cancels the edit without saving it. ## Custom Roles As an organization administrator, you can create custom roles by combining APIs or applications, permissions, and users. Available options vary by product. For example, API roles can’t be removed and their permissions can’t be modified, but you can add a description and assign users to the role. > [!NOTE] Product permissions are specific to a single environment. If you have multiple > environments and want to give a role the same permissions on all, you must add these permissions > multiple times—​one for each environment. ### Create a Custom Role 1. Sign in to Anypoint Platform using an account that has the Organization Administrator permission. 2. Select **Access Management** from the ![gear icon](/mulesoft/current/en-us/access-management/_images/gear.svg) menu. 3. In the Access Management navigation menu, select **Business Groups**. 4. Select the name of the organization to access. 5. Select the **Roles** tab. 6. Click **Add role**. 7. Enter a **Name** and **Description** for your custom role. Your custom role now appears in your list of roles. 8. Click the name of your new role to assign permissions to it. After creating a custom role, you can access more information about that role, change its name and description, add permissions to it, or assign this role to specific users. > [!NOTE] When editing role names and descriptions, use the 'Enter' key to save changes. Clicking > outside the text box cancels the edit without saving it. ### Add a User to a Custom Role After creating a custom role, you can assign users to the role. 1. Sign in to Anypoint Platform. 2. Select **Access Management** from the ![gear icon](/mulesoft/current/en-us/access-management/_images/gear.svg) menu. 3. In the Access Management navigation menu, select **Business Groups**. 4. Select the name of the organization to access. 5. Select the **Roles** tab. 6. Click the name of the custom role to add users to. 7. Click the **Users** tab, then enter a username or email in the search field. 8. Select the user, then click the **+** icon. ### Assign Permission Scopes to a Custom Role After creating a custom role, you can assign permissions to the role. Some permissions within a role can be applied to specific environments. If these environments belong to a business group rather than the root organization, they’re available only when creating a role in that same business group. 1. Sign in to Anypoint Platform using an account that has the Organization Administrator permission. 2. Select **Access Management** from the ![gear icon](/mulesoft/current/en-us/access-management/_images/gear.svg) menu. 3. In the Access Management navigation menu, select **Business Groups**. 4. Select the name of the organization to access. 5. Select the **Roles** tab. 6. Click the name of the custom role to add permission scopes to. 7. Select the **Permissions** tab, and click **Add Permissions**. 8. Select the permissions to add and click **Next**. The list of **Permissions** includes all permissions, even if they are already assigned to users. If you add a permission that’s already assigned, there is no effect. 9. Select which environments to apply the permission to if it’s enabled for the permission. 10. Click **Next**. 11. Review the permissions and environments they apply to, and then click **Add Permissions**. The permissions you selected now apply to the members of the role and appear in the **Permissions** section for the role. ### Enable Access to Design Center After creating a custom role, grant the Design Center Developer, Design Center Viewer, or Design Center Creator permission scope to the custom role to enable access to Design Center. 1. Sign in to Anypoint Platform. 2. Select **Access Management** from the ![gear icon](/mulesoft/current/en-us/access-management/_images/gear.svg) menu. 3. In the Access Management navigation menu, select **Business Groups**. 4. Select the name of the organization to access. 5. Select the **Roles** tab. 6. Click the name of the custom role you want to add users to. 7. Click **Permissions**, then click **Add permissions**. 8. In the Design Center section, next to each permission you want to grant the user, select the checkbox. 9. Click **Next** and then click **Add permissions** to add the permission. ### Assign API Permissions to a Custom Role #### API Manager 1.x You can associate an API to a custom role. This enables you to create roles that give users access to a specific API. 1. Sign in to Anypoint Platform. 2. Select **Access Management** from the ![gear icon](/mulesoft/current/en-us/access-management/_images/gear.svg) menu. 3. In the Access Management navigation menu, select **Business Groups**. 4. Select the name of the organization to access. 5. Select the **Roles** tab. 6. Click the name of the custom role to grant API access to. Custom roles have a radial button next to them. 7. Click **Permissions**, then click **APIs**. 8. Select an API from the drop-down list. 9. Select the API version. Select **All** to enable access to all versions of this API. 10. Select the permission from the drop-down list. You can add the following permissions to an API: - API Version Owner - Portal Viewer ### API Manager 2.x You can associate environment permissions to the custom role. This enables you to create roles that give users different permissions over environments. 1. Sign in to Anypoint Platform. 2. Select **Access Management** from the ![gear icon](/mulesoft/current/en-us/access-management/_images/gear.svg) menu. 3. In the Access Management navigation menu, select **Business Groups**. 4. Select the name of the organization to access. 5. Select the **Roles** tab. 6. Click the name of the custom role to grant API access to. Custom roles have a radial button next to them. 7. Click **Permissions**, then click **API Manager**. 8. Select an environment from the drop-down list. 9. Select the permission from the drop-down list. You can add the following permissions to an environment: - API Manager Environment Administrator - Deploy API Proxy - Manage API Alerts - Manage APIs Configuration - Manage Contracts - Manage Policies - View API Alerts - View APIs Configuration - View Contracts - View Policies ## Role Mapping You can set up your Anypoint Platform organization so that when a SAML user belongs to certain groups, Anypoint Platform automatically grants certain equivalent roles in your Anypoint Platform organization. ## Migrate Roles to Teams After you opt in to the Teams feature, you can convert existing roles into permissions, convert roles to teams, or merge roles with teams. When you convert or merge a role, the role is deleted. ### Convert a Role to Permissions When you convert roles to permissions, users keep the same permissions that they previously received with roles. > [!WARNING] When you convert a role to permissions, the users who previously belonged to the role > are no longer grouped according to their permissions and must be managed individually. > Additionally, roles that can now be applied as (or converted to) permissions, such as the Exchange > Contributors permission, can be managed only while you’re using the Teams feature. 1. Sign in to Anypoint Platform using an account that has the Organization Administrator permission. 2. Select **Access Management** from the ![gear icon](/mulesoft/current/en-us/access-management/_images/gear.svg) menu. 3. In the Access Management navigation menu, select **Business Groups**. 4. Select the name of the organization to access. 5. Select the **Roles** tab. 6. Next to the role that you want to convert, click the **…​** menu. 7. Click **Convert to permissions…​**. 8. Click **Convert to Permissions**. The users who previously had the role are granted the same permissions that the role granted them, and the role is deleted. ### Convert a Role to a Team When you convert a role to a team, you create a new team that contains the users who previously held the converted role. The team you create also inherits permissions from the parent team you create it under. 1. Sign in to Anypoint Platform using an account that has the Organization Administrator permission. 2. Select **Access Management** from the ![gear icon](/mulesoft/current/en-us/access-management/_images/gear.svg) menu. 3. In the Access Management navigation menu, select **Business Groups**. 4. Select the name of the organization to access. 5. Select the **Roles** tab. 6. Next to the role that you want to convert, click the **…​** menu. 7. Click **Convert to team…​**. 8. Enter a name for your new team. You can use alphanumeric characters, hyphens, and spaces in your team name. 9. Select a parent team. The team you’re creating also inherits permissions from the parent team you select. 10. Click **Convert to Team**. The users who previously had the role are added to a new team that has the same permissions as those granted by the role, and the role is deleted. Any external names formerly associated with the role are associated with the new team. ### Merge a Role with a Team When you merge a role with a team, the users who previously had the role keep the permissions granted by that role and also obtain permissions included in the team they have joined. 1. Sign in to Anypoint Platform using an account that has the Organization Administrator permission. 2. Select **Access Management** from the ![gear icon](/mulesoft/current/en-us/access-management/_images/gear.svg) menu. 3. In the Access Management navigation menu, select **Business Groups**. 4. Select the name of the organization to access. 5. Select the **Roles** tab. 6. Next to the role that you want to convert, click the **…​** menu. 7. Click **Merge with team…​**. 8. Select the team to merge the role members with. 9. Click **Merge with Team**. The users who previously had the role are added to the selected team along with the role permissions, and the role is deleted. Any external names formerly associated with the role are associated with the selected team. ## View Limits for a Role Each role has a **Limits** section that shows how close it is to hitting limits imposed by Anypoint Platform. This feature is available only in the new Access Management user interface. To view limits: 1. In the Access Management navigation menu, select **Business Groups**. 2. Select the name of the organization to access. 3. Select the **Roles** tab. 4. Click the role with the limits you want to view. 5. Click the **Limits** tab. For more information on limits in Access Management, see [Limits](https://docs.mulesoft.com/access-management/troubleshooting-anypoint-platform-access#access-management-limits). ## See Also - [Teams](https://docs.mulesoft.com/access-management/teams) - [Anypoint Platform Business Groups](https://docs.mulesoft.com/access-management/business-groups) - [Manage Permissions](https://docs.mulesoft.com/access-management/managing-permissions) - [Design Center](https://docs.mulesoft.com/design-center/) - [Map Users to Roles in an LDAP Group](https://docs.mulesoft.com/access-management/map-users-roles-teams) - [Environments](https://docs.mulesoft.com/access-management/environments) --- product: Access Management version: master --- # Using Teams to Manage User Permissions > For the full documentation index, see: https://docs.mulesoft.com/llms.txt Use the Teams feature to seamlessly manage user permissions and team membership as your organization grows. Create groups of users and then assign the members of those groups selected permissions. Teams have a cascading permissions structure, so managing users and permissions is scalable. Adopting a team structure for your organization also enables you to share assets more easily. For example, in Anypoint Exchange, you can share an asset with an entire team rather than having to select each user individually. As a root organization administrator, you can: - Manage your organization from a simple, global view. - Group users into teams to manage permissions and share assets. - Assign both global and team-level permissions. - Assign team maintainers to delegate management of team members and child teams. - Manage user and team permissions across multiple business groups in one place. ## Permissions Structure Teams are hierarchical, starting with the **Everyone at ** team, or the root team, which contains all users who join your organization either via an invitation or SSO. When you create teams, use a structure that reflects the structure of your organization so that you can plan your teams and configure permissions according to member needs. For example, you can create teams based on geographical regions or specific job functions. When you’re planning your organization’s team structure, keep in mind that: - All users in your organization belong to the **Everyone at ** team. When you configure permissions in your organization, assign only permissions you want every user in the root team to have. - You can move teams within the hierarchy if the needs of your organization change. - Teams names must be unique across your organization. - Your organization can have up to 1000 teams. - You can nest teams up to 10 levels, including the **Everyone at ** team. - You can create teams without adding members. - Every child team inherits permissions from its parent team. You can add permissions to the inherited set of permissions to give each child team more specialized permissions that reflect the team members’ responsibilities. For an example of a teams structure applied across an organization, see [Example Teams Structure](https://docs.mulesoft.com/access-management/teams-example). ## Grant Permissions to Individual Users If you have the Organization Administrator permission, you can assign permissions to individual users without assigning those users to a team. For more information about assigning permissions to individual users, see [Grant Permissions and Roles to Users](https://docs.mulesoft.com/access-management/users#grant-user-permissions). ## See Also - [Configure Teams](https://docs.mulesoft.com/access-management/configure-teams) - [Example Teams Structure](https://docs.mulesoft.com/access-management/teams-example) - [Inviting a User to Anypoint Platform](https://docs.mulesoft.com/access-management/users#inviting-a-user-to-anypoint-platform) - [Grant Permissions and Roles to Users](https://docs.mulesoft.com/access-management/users#grant-user-permissions) - [Map SSO Users to Teams](https://docs.mulesoft.com/access-management/map-users-roles-teams) --- product: Access Management version: master --- # Verifying SAML Information > For the full documentation index, see: https://docs.mulesoft.com/llms.txt During verification of SAML information, if you determine that information requires a change, log in to the MuleSoft Support Portal and submit a request. 1. In Anypoint Platform, click Access Management > External Identity. 2. From Identity Management, select SAML 2.0. Your SAML 2.0 configuration appears. 3. Verify that the group\_attribute value is set to the correct attribute name. In the following example of a SAML assertion, the group\_attribute is "memberOf": ```xml cn=jira-users,ou=groups,dc=muleforge,dc=org cn=confluence-users,ou=groups,dc=muleforge,dc=org cn=mule-community,ou=groups,dc=muleforge,dc=org cn=SR-User,ou=Groups,dc=muleforge,dc=org ``` ## See Also [MuleSoft Support Portal](https://www.mulesoft.com/support-login) --- product: Access Management version: master --- # View a SAML Response in the Browser > For the full documentation index, see: https://docs.mulesoft.com/llms.txt To view your SAML response in a browser, perform a single sign-on (SSO) and use the developer tools in your browser to find the bearer token and SAML response. > [!NOTE] Complete this task before calling the MuleSoft Support team to assist you in > troubleshooting your SAML 2.0 compliant SSO setup. 1. Open a new tab in your browser and open Chrome Developer Tools: 1. In the Chrome developer tool: 2. Select the **Network** tab. 3. Select **Preserve log**. 4. Optionally, if the **Method** column isn’t visible in the Developer Tools Network log pane, right-click any column label and select **Method**. 2. In the Access Management navigation menu, click **Business Groups**. 3. Click the name of your root organization. 4. Click the **Settings** tab. 5. Copy the domain name. 6. Go to `anypoint.mulesoft.com/accounts/login/_domain_name_`. This will redirect you to your IDP’s single sign-on page. 7. Enter the IDP account credentials and authenticate yourself. 8. In **Headers**, look for a SAML Post in the Developer Tools Network log pane and select it. Other tools or tracers might have different labels. . Record the SAML response element. After recording the SAML response, use it to [obtain a bearer token](https://docs.mulesoft.com/access-management/saml-bearer-token) to access platform APIs. It’s also useful to record the SAML response to provide to MuleSoft support if you contact them. 1. Log in to the MuleSoft Support Portal: https://www.mulesoft.com/support-login 2. Provide a screenshot of your SAML configuration in Anypoint Platform. 3. Include an XML SAML assertion. ## Example: Chrome Developer Tools SAML Response Element This image shows a SAML response element in Chrome developer tools after signing in to Anypoint Platform using SSO: ![A Chrome developer tools screenshot showing an API request in progress](/mulesoft/current/en-us/access-management/_images/iam-chromedevtools.png) Figure 1. SAML response element after signing in to Anypoint Platform in Google Chrome. In the **Network** tab (1), the `receive-id` line (2) indicates that you attempted to sign in to Anypoint Platform using single signon through your identity provider. Because the signin is successful, you can expand `receive-id` and access form data that contains your SAML response element (3). Unsuccessful signin attempts still generate SAML response elements. ## See Also - [Known Issues](https://help.salesforce.com/s/issues)