1. Use a user account with an Admin role to generate an access token.

2. Create a Service Account via the API.

   	curl -X POST -s -i https://api.flexera.com/iam/v1/orgs/$ORG_ID/service-accounts \
   	-H "Content-Type: application/json" \
   	-H "Authorization: Bearer $USER_TOKEN" \
   	-d '{"name": "service account name", "description": "Reads data from Flexera One APIs"}'
   

   NOTE: Replace $ORG_ID with your Organization ID.

3. Find the created service account and get its ID.
   

   	curl -s https://api.flexera.com/iam/v1/orgs/$ORG_ID/service-accounts/2263 \
   	  -H "Authorization: Bearer $USER_TOKEN" | jq
   

   Example:

   

4. Assign role(s) to the service account. The service account should be granted the least possible permissions to accomplish its tasks. For Flexera One ITAM, you want to grant the service account the 'fnms_admin' role.
   
   To check available roles:

   	curl -s https://api.flexera.com/iam/v1/orgs/$ORG_ID/roles \
      -H "Authorization: Bearer $USER_TOKEN" | jq
   

   
   Example:
   

5.  Assign the 'fnms_admin' role to your service account.

   	curl -s https://api.flexera.com/iam/v1/orgs/$ORG_ID/access-rules/grant -X PUT -i \
   	 -H "Content-Type: application/json" \
   	 -H "Authorization: Bearer $USER_TOKEN" \
   	 -d '{
   	  "role": {
   	    "name": "fnms_admin"
   	  },
   	  "scope": { 
   	      "ref":"ref:nam:::iam:org:$ORG_ID"
   	
   	  },
   	  "subject": {
   	    "ref": "ref:nam:$ORG_ID::iam:service-account:$SERVICE_ACCOUNT_ID"
   	    
   	  }
   	}'
   

   Example (body):
   

   NOTE: Replace $ORG_ID with your Organization ID and $SERVICE_ACCOUNT_ID with the Service Account ID you have created.

6. Use the Identity and Access Management API to create a service account client. The client contains the service account's credentials.
    

   	curl -s https://api.flexera.com/iam/v1/orgs/$ORG_ID/service-accounts/$SERVICE_ACCOUNT_ID/clients \
   	  -H "Authorization: Bearer $USER_TOKEN" -X POST
   

   Example:
   

   IMPORTANT: The clientId and clientSecret must be stored securely, as they are sensitive. Anyone with access to these credentials will have access to your organization.

7. Obtain a bearer token using service account credentials.

   curl -s -i -X POST https://login.flexera.com/oidc/token \   
   -H "Content-Type: application/x-www-form-urlencoded" \   
   -d "grant_type=client_credentials&client_id=<client Id>&client_secret=<client secret>"

   Example (body):
   

8. In Flexera One, navigate to IT Asset Account, search for the service account, and open it to trigger a sync. Optionally, assign an ITAM role.

You can now use the Service Account to call any Flexera One ITAM API.
 

IT Asset Management Data API