---
schema_version: "1"
id: 3336c5d73b698f8b3b2d917de6eb82ec205895cd6cfdf0d7fe62dc84200a24a4
title: Requesting Access
collection: mulesoft
version: current
locale: en-us
portal_url: https://docs.salesforce.com/mulesoft/current/en-us/exchange/to-request-access.md
canonical_url: https://docs.mulesoft.com/exchange/to-request-access
source_site: docs.mulesoft.com
content_type: documentation
content_hash: 4a813b563724db951bebedadfaf6299fedac5984cb4afcd6c240933f925d60a2
description: MuleSoft Documentation Site
latest: true
---
---
product: Exchange
---

# Requesting Access

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

To register a client application to an existing API instance or API Group instance, the client
application requests access. When the owner of the instance approves the request, a contract is
created between the client application and the instance, and the client application is registered.

Instances that are protected by a client ID enforcement policy require client applications to
provide a client ID and optional client secret. The client ID and client secret credentials are
automatically created when the client application is registered.

An instance owner can use API Manager to view all API contracts ever created for an API instance or
API Group instance. An API or API Group consumer can use the **My Applications** page in Exchange to
view the API contracts created between an API instance or API Group instance and that consumer’s
client applications.

API providers can view, manage, and revoke these contracts by following the steps in
[Managing API Instance Contracts on API Manager](https://docs.mulesoft.com/api-manager/latest/manage-client-apps-latest-task).

Both API instance owners and the owners of a specific client application can request access to that
client application. All other users must request access from either of these owners. For access to a
client application created by another user, request that either the client application owner or the
API instance owner grant access to you by adding your user account to the application owners list in
Anypoint API Manager.

If terms and conditions are set for an asset, you are prompted to accept the terms before access is
granted, and the created contract includes the terms and conditions.

1.  Click an API or API Group asset to view more details.

2.  Click **Request access**.

3.  Choose the instance from the list.

4.  If you are using an existing application, choose from the list of applications.

    An application and its instance use the same client provider. If an organization administrator
    has configured
    [multiple client providers](https://docs.mulesoft.com/api-manager/latest/configure-multiple-credential-providers) in
    Anypoint API Manager, then the application list shows only the applications that use the same
    client provider as the selected instance.

5.  If you do not have an application to which to provide access, click **Select application >
    Create a new application**.

    For more information, see the Create a New Application section.

6.  Choose the service-level agreement (SLA) value for the application.

7.  Click **Request access**.

    The **Request API Access** menu opens to show that the access was automatically granted or
    submitted for review. This screen lists the client ID and client secret for this access
    instance.

## Create a New Application

Choose from the screens that follow for what to provide:

- If an organization uses OAuth authentication, this screen appears:

  ![The Create new application dialog showing fields to update for an OAuth authentication](/mulesoft/current/en-us/exchange/_images/ex2-edit-app2.png)

  Specify:

  - The application name.

  - An optional description for the application.

  - An optional application URL for where the app resides. If not specified, the app is assumed to
    be in the Runtime Manager.

  - An optional URL for an OAuth 2 callback.

- If an organization has external authentication, this screen appears:

  ![The Edit application dialog showing fields to update for an external authentication](/mulesoft/current/en-us/exchange/_images/ex2-edit-app.png)

  Specify the same values as above, but also:

  The OAuth 2 grant type:

  - Implicit Grant

  - Authorization Code Grant

  - Refresh Token

## API Group Access

In Exchange, each API Group is an asset with a portal. The **Group instances** page on the portal
lists all of that API Group’s instances.

When a developer requests access to the API Group for a client application, the developer selects an
API Group instance, selects or creates a client application, and optionally selects a service-level
agreement (SLA).

A client application can access an API either through a contract with only that API or through a
contract with one or more API Groups that include the API. In this latter case, the least
restrictive available contract for the API is applied.

## See Also

- [Search to compare grant types](https://www.google.com/search?q=oauth2+implicit+grant+vs+authorization+code+grant+refresh+token&oq=oauth2+implicit+grant+vs+authorization+code+grant+refresh+token)