{"templateId":"markdown","sharedDataIds":{"sidebar":"sidebar-docs/guides/sidebars.yaml","api-docs-docs/openapi/health-v1.yaml":"api-docs-docs/openapi/health-v1.yaml"},"props":{"metadata":{"markdoc":{"tagList":["admonition","openapi-code-sample"]},"type":"markdown"},"seo":{"title":"Service Users"},"dynamicMarkdocComponents":["openapi"],"compilationErrors":[],"ast":{"$$mdtype":"Tag","name":"article","attributes":{},"children":[{"$$mdtype":"Tag","name":"Heading","attributes":{"level":1,"id":"service-users","__idx":0},"children":["Service Users"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["DeepCredentials authenticates B2B callers as ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["DeepAdmin service users"]},". There is no portal-side credential to mint — identity is delegated to the DeepCloud Identity Provider (Keycloak), and every B2B request carries a short-lived JWT obtained from there."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"how-identity-is-structured","__idx":1},"children":["How identity is structured"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Your partner client"]}," is a Keycloak client created for you by the DeepCloud team. It identifies your integration globally."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Service users"]}," are accounts created under your partner client, typically one per end-client organization you serve. Each one has its own ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["username"]}," + ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["password"]}," that your code uses to authenticate."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Organizations"]}," are the DeepAdmin entity that resources are scoped to. A service user can be a member of one or many organizations."]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["On every call, the portal verifies that the service user behind the bearer token is a member of the organization you supply in the ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["X-Org-Id"]}," header."]},{"$$mdtype":"Tag","name":"Admonition","attributes":{"type":"info","name":"A note on Keycloak realms"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["A ",{"$$mdtype":"Tag","name":"em","attributes":{},"children":["realm"]}," in Keycloak is an isolated tenant inside a Keycloak deployment — its own users, clients, scopes, and signing keys. DeepCloud's realm is named ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["sso"]},", and each environment (",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["int"]}," for testing, prod for live) runs its own Keycloak deployment with its own ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["sso"]}," realm. A service user provisioned against ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["int.deepcloud.swiss"]}," is ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["not"]}," valid against ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["deepcloud.swiss"]}," and vice versa."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"provisioning","__idx":2},"children":["Provisioning"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Provisioning happens in DeepCloud, not in DeepCredentials. The canonical, always-current walkthrough is ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"https://apidocs.deepcloud.swiss/deepsign-api-docs/setup_overview.html"},"children":["DeepCloud — API Access Setup and Authorization Overview"]}]},". Read it for the URLs, the form parameters, the authorization-method options, and the credential-delivery modes — we deliberately don't duplicate them here so they can't go stale."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The high-level shape (use the left-nav on the DeepCloud page to jump to each step):"]},{"$$mdtype":"Tag","name":"ol","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["API Access Setup"]}," — the DeepCloud team gives you a ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Partner-Service-Client-ID"]}," and ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Partner-Service-Client-Secret"]}," (or a JWKS configuration). When you contact them, also ask them to allow the ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["deepcredentials.*"]}," scopes you'll need (see the Scopes table below)."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Service User Creation"]}," — for every end-client organization you serve, that organization's owner authorizes your partner client and you receive a ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["service_account_username"]}," + ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["service_account_password"]}," bound to that org."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Store the credentials in your own secret manager — one client-level secret, plus one service-user credential pair per end client."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"exchanging-credentials-for-an-access-token","__idx":3},"children":["Exchanging credentials for an access token"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Use the OAuth 2.0 Resource Owner Password Credentials grant against DeepCloud's Keycloak token endpoint, requesting the scopes your endpoints need:"]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"bash","header":{"controls":{"copy":{}}},"source":"curl -X POST \"https://deepcloud.swiss/auth/realms/sso/protocol/openid-connect/token\" \\\n  --data-urlencode \"grant_type=password\" \\\n  --data-urlencode \"username=<service_account_username>\" \\\n  --data-urlencode \"password=<service_account_password>\" \\\n  --data-urlencode \"client_id=<Partner-Service-Client-ID>\" \\\n  --data-urlencode \"client_secret=<Partner-Service-Client-Secret>\" \\\n  --data-urlencode \"scope=deepcredentials.issue deepcredentials.verify deepcredentials.self-service\"\n","lang":"bash"},"children":[]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["scope"]}," parameter is a space-separated list of the OAuth scopes you want on the returned token; ask for the ones your integration uses. If DeepCloud's partner-client config doesn't allow a scope, Keycloak silently drops it from the response — always inspect the ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["scope"]}," claim on the issued token to confirm."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["For the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["test"]}," environment, replace ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["deepcloud.swiss"]}," with ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["int.deepcloud.swiss"]},"."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Response:"]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"json","header":{"controls":{"copy":{}}},"source":"{\n  \"access_token\": \"eyJhbGciOiJSUzI1NiIs…\",\n  \"expires_in\": 900,\n  \"refresh_expires_in\": 36000,\n  \"refresh_token\": \"eyJhbGciOiJIUzI1NiIs…\",\n  \"token_type\": \"Bearer\",\n  \"scope\": \"deepcredentials.issue deepcredentials.verify deepcredentials.self-service\"\n}\n","lang":"json"},"children":[]},{"$$mdtype":"Tag","name":"Admonition","attributes":{"type":"warning","name":"Cache tokens, don't re-fetch every call"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Access tokens are valid for ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["expires_in"]}," seconds (900 = 15 min). Cache them and re-use until close to expiry. Re-fetching for every API call drives unnecessary load on DeepCloud's IdP and adds avoidable latency. A common pattern is to refresh when less than 30 seconds of validity remain. The ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["refresh_token"]}," lets you extend without re-sending ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["username"]},"/",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["password"]},"."]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The JWKS-based client-assertion variant (signs a JWT with your private key instead of presenting a ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["client_secret"]},") is covered under ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Token Endpoint"]}," in ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"https://apidocs.deepcloud.swiss/deepsign-api-docs/setup_overview.html"},"children":["DeepCloud — API Access Setup and Authorization Overview"]}]}," — switch the ",{"$$mdtype":"Tag","name":"em","attributes":{},"children":["Authorization Method"]}," selector on their page to \"JWKS\" to surface the relevant request shape and code samples."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["You do not need to configure an audience on your side — Keycloak attaches a default ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["aud"]}," claim that the portal trusts."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"calling-the-api","__idx":4},"children":["Calling the API"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Send three headers on every ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["/b2b/v1/*"]}," request:"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Header"},"children":["Header"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Value"},"children":["Value"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Authorization"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Bearer <access_token>"]}," from the token response above."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["X-Org-Id"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["UUID of the organization this call is acting on. The service user must be a member."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["X-Environment"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["beta"]}," or ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["production"]},". Resources are isolated per environment."]}]}]}]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["A worked example:"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/docs/openapi/health-v1"},"children":["Open in API reference →"]}]},{"$$mdtype":"Tag","name":"OpenApiCodeSample","attributes":{"descriptionFile":"api-docs-docs/openapi/health-v1.yaml","operationId":"GET:b2b.Health","parameters":{},"environments":{"https://api.dev.deepcredentials.swiss":{"BearerAuth":"YOUR_ACCESS_TOKEN"}},"environment":"https://api.dev.deepcredentials.swiss","codeSamplesResolved":[{"lang":"shell","title":"curl","source":"curl -i -X GET \\\n  https://api.dev.deepcredentials.swiss/b2b/v1/health \\\n  -H 'X-Environment: beta' \\\n  -H 'X-Org-Id: 497f6eca-6276-4993-bfeb-53cbbbba6f08'"},{"lang":"javascript","title":"JavaScript","source":"const resp = await fetch(\n  `https://api.dev.deepcredentials.swiss/b2b/v1/health`,\n  {\n    method: 'GET',\n    headers: {\n      'X-Org-Id': '497f6eca-6276-4993-bfeb-53cbbbba6f08',\n      'X-Environment': 'beta'\n    }\n  }\n);\n\nconst data = await resp.text();\nconsole.log(data);"},{"lang":"javascript","title":"Node.js","source":"import fetch from 'node-fetch';\n\nasync function run() {\n  const resp = await fetch(\n    `https://api.dev.deepcredentials.swiss/b2b/v1/health`,\n    {\n      method: 'GET',\n      headers: {\n        'X-Org-Id': '497f6eca-6276-4993-bfeb-53cbbbba6f08',\n        'X-Environment': 'beta'\n      }\n    }\n  );\n\n  const data = await resp.text();\n  console.log(data);\n}\n\nrun();"},{"lang":"python","title":"Python","source":"import requests\n\nurl = \"https://api.dev.deepcredentials.swiss/b2b/v1/health\"\n\nheaders = {\n  \"X-Org-Id\": \"497f6eca-6276-4993-bfeb-53cbbbba6f08\",\n  \"X-Environment\": \"beta\"\n}\n\nresponse = requests.get(url, headers=headers)\n\ndata = response.json()\nprint(data)"},{"lang":"java","title":"Java","source":"import java.net.*;\nimport java.net.http.*;\nimport java.util.*;\n\npublic class App {\n  public static void main(String[] args) throws Exception {\n    var httpClient = HttpClient.newBuilder().build();\n\n    var host = \"https://api.dev.deepcredentials.swiss\";\n    var pathname = \"/b2b/v1/health\";\n    var request = HttpRequest.newBuilder()\n      .GET()\n      .uri(URI.create(host + pathname ))\n      .header(\"X-Org-Id\", \"497f6eca-6276-4993-bfeb-53cbbbba6f08\")\n      .header(\"X-Environment\", \"beta\")\n      .build();\n\n    var response = httpClient.send(request, HttpResponse.BodyHandlers.ofString());\n\n    System.out.println(response.body());\n  }\n}"},{"lang":"csharp","title":"C#","source":"using System;\nusing System.Net.Http;\nusing System.Threading.Tasks;\n\npublic class Program\n{\n  public static async Task Main()\n  {\n    System.Net.Http.HttpClient client = new()\n    {\n      DefaultRequestHeaders =\n      {\n        {\"X-Org-Id\", \"497f6eca-6276-4993-bfeb-53cbbbba6f08\"},\n        {\"X-Environment\", \"beta\"},\n      }\n    };\n\n    using HttpResponseMessage request = await client.GetAsync(\"https://api.dev.deepcredentials.swiss/b2b/v1/health\");\n    string response = await request.Content.ReadAsStringAsync();\n\n    Console.WriteLine(response);\n  }\n}"},{"lang":"php","title":"PHP","source":"/**\n * Requires libcurl\n */\n\n$curl = curl_init();\n\ncurl_setopt_array($curl, [\n  CURLOPT_HTTPHEADER => [\n    \"X-Environment: beta\",\n    \"X-Org-Id: 497f6eca-6276-4993-bfeb-53cbbbba6f08\"\n  ],\n  CURLOPT_URL => \"https://api.dev.deepcredentials.swiss/b2b/v1/health\",\n  CURLOPT_RETURNTRANSFER => true,\n  CURLOPT_CUSTOMREQUEST => \"GET\",\n]);\n\n$response = curl_exec($curl);\n$error = curl_error($curl);\n\ncurl_close($curl);\n\nif ($error) {\n  echo \"cURL Error #:\" . $error;\n} else {\n  echo $response;\n}"},{"lang":"go","title":"Go","source":"package main\n\nimport (\n  \"fmt\"\n  \"net/http\"\n  \"io/ioutil\"\n)\n\nfunc main() {\n  reqUrl := \"https://api.dev.deepcredentials.swiss/b2b/v1/health\"\n  req, err := http.NewRequest(\"GET\", reqUrl, nil)\n  if err != nil {\n    panic(err)\n  }\n  req.Header.Add(\"X-Org-Id\", \"497f6eca-6276-4993-bfeb-53cbbbba6f08\")\n  req.Header.Add(\"X-Environment\", \"beta\")\n  res, err := http.DefaultClient.Do(req)\n  if err != nil {\n    panic(err)\n  }\n  defer res.Body.Close()\n  body, err := ioutil.ReadAll(res.Body)\n  if err != nil {\n    panic(err)\n  }\n\n  fmt.Println(res)\n  fmt.Println(string(body))\n}"},{"lang":"ruby","title":"Ruby","source":"require 'uri'\nrequire 'net/http'\nrequire 'openssl'\n\nurl = URI('https://api.dev.deepcredentials.swiss/b2b/v1/health')\n\nhttp = Net::HTTP.new(url.host, url.port)\nhttp.use_ssl = true\n\nrequest = Net::HTTP::Get.new(url)\nrequest['X-Org-Id'] = '497f6eca-6276-4993-bfeb-53cbbbba6f08'\nrequest['X-Environment'] = 'beta'\n\nresponse = http.request(request)\nputs response.read_body\n"},{"lang":"r","title":"R","source":"library(httr)\n\nurl = \"https://api.dev.deepcredentials.swiss/b2b/v1/health\"\n\ndata_req <- GET(\n  url,\n  add_headers(\"X-Org-Id\" = \"497f6eca-6276-4993-bfeb-53cbbbba6f08\", \"X-Environment\" = \"beta\"),\n  verbose()\n)\n\ncontent(data_req)"}]},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"scopes","__idx":5},"children":["Scopes"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Scope"},"children":["Scope"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Grants access to"},"children":["Grants access to"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["deepcredentials.issue"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Create credential offers, list and inspect issued credentials, suspend / revoke / reactivate."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["deepcredentials.verify"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Create and read OID4VP verification sessions."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["deepcredentials.self-service"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Read and decide on end-user-initiated self-service requests."]}]}]}]}]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Endpoint"},"children":["Endpoint"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Required scope"},"children":["Required scope"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["POST /b2b/v1/credential-offers"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["deepcredentials.issue"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["GET /b2b/v1/credential-offers[/...]"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["deepcredentials.issue"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["GET /b2b/v1/issued-credentials[/...]"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["deepcredentials.issue"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["PATCH /b2b/v1/issued-credentials/:id/status"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["deepcredentials.issue"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["POST /b2b/v1/verification-sessions"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["deepcredentials.verify"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["GET /b2b/v1/verification-sessions[/...]"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["deepcredentials.verify"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["GET /b2b/v1/self-service/requests/:requestId"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["deepcredentials.self-service"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["POST /b2b/v1/self-service/requests/:requestId/decision"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["deepcredentials.self-service"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["GET /b2b/v1/health"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["— (authenticated, no scope required)"]}]}]}]}]},{"$$mdtype":"Tag","name":"Admonition","attributes":{"type":"info","name":"Least privilege"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Only request the scopes your integration uses. If you only verify identities, ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["scope=deepcredentials.verify"]}," is sufficient."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"errors-you-may-see","__idx":6},"children":["Errors you may see"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Status"},"children":["Status"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Code"},"children":["Code"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Cause"},"children":["Cause"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["400"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["invalid_argument"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Missing or malformed ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["X-Org-Id"]}," / ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["X-Environment"]}," header, or a missing required field in the request body."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["401"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["unauthenticated"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Bearer token failed validation: bad signature, expired (",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["exp"]}," in the past), wrong issuer, or wrong audience."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["403"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["permission_denied"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["The token doesn't carry the scope the endpoint requires. Inspect the ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["scope"]}," claim on the issued token — if a scope you requested is missing, the partner client isn't configured to grant it (contact DeepCloud)."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["404"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["not_found"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Either the resource ID is unknown, or the ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["X-Org-Id"]}," you supplied isn't an organization the authenticated service user is a member of. The portal returns the same code for both to avoid leaking organization existence."]}]}]}]}]}]},"headings":[{"value":"Service Users","id":"service-users","depth":1},{"value":"How identity is structured","id":"how-identity-is-structured","depth":2},{"value":"Provisioning","id":"provisioning","depth":2},{"value":"Exchanging credentials for an access token","id":"exchanging-credentials-for-an-access-token","depth":2},{"value":"Calling the API","id":"calling-the-api","depth":2},{"value":"Scopes","id":"scopes","depth":2},{"value":"Errors you may see","id":"errors-you-may-see","depth":2}],"frontmatter":{"seo":{"title":"Service Users"}},"lastModified":"2026-06-10T12:08:36.000Z","pagePropGetterError":{"message":"","name":""}},"slug":"/docs/guides/authentication/service-users","userData":{"isAuthenticated":false,"teams":["anonymous"]},"isPublic":true}