API Documentation

Azure OAuth

Azure AD OAuth 2.0 Client Credentials (M2M) Setup

This guide details the two-part setup required in Microsoft Entra ID (Azure AD) to use the OAuth Machine-to-Machine (M2M) flow for securing your DecisionRules Solver API Key.

Part I: DecisionRules Resource Application Setup

The Resource Application represents the DecisionRules Solver API itself. This is where you define the custom scope that grants access to your specific Organization and Space.

Step 1: Register the DecisionRules Resource API

  1. Sign in to the Microsoft Entra admin center.

  2. Navigate to Identity > Applications > App registrations.

  3. Click + New registration.

  4. Name: Enter DecisionRules Solver API Resource (or similar).

  5. Supported account types: Select your desired tenant option (e.g., Accounts in this organizational directory only).

  6. Click Register.

Step 2: Define the Application ID URI (The AUD Claim)

This URI uniquely identifies the DecisionRules Resource API and will be used as the Audience (AUD) for validation.

  1. From the new App Registration overview page, navigate to Manage > Expose an API.

  2. Next to Application ID URI, click Set.

  3. Accept the default URI format (e.g., api://<Application (client) ID>) or define your own (e.g., https://decisionrules.io/solver-api).

  4. RECORD THIS FULL URI. This value is critical and must be provided to the DecisionRules platform during your Organization's OAuth setup.

Step 3: Create the Custom Scope

This scope embeds your specific Organization and Space identifiers, ensuring fine-grained authorization.

  1. In the same Expose an API blade, scroll down to Scopes defined by this API.

  2. Click + Add a scope.

  3. Configure the scope using your provided identifiers:

Field

Value

Scope name

decisionrules:orgid:12b057b4-865b-4545-81c4-8899d1da3537:spaceid:8ba6bac9-08a8-e648-8a2c-0b3992a9b4d6:solver

Who can consent?

Select Admins only (Recommended for M2M flow)

Admin consent display name

Access DecisionRules Solver API for specific Org/Space

Admin consent description

Allows machine clients to execute rules on the specified DecisionRules Organization and Space.

State

Enabled

  1. Click Add scope.

Part II: Client Application Setup

The Client Application represents your calling service (e.g., your ERP, microservice, or back-end automation). This application requests the token.

Step 1: Register the Client Application

  1. Navigate back to App registrations and click + New registration.

  2. Name: Enter a name for your calling service (e.g., My ERP Client Service).

  3. Click Register.

  4. From the overview page, record the Application (client) ID (your Client ID) and the Directory (tenant) ID (your Tenant ID).

Step 2: Create Client Credentials

  1. From the client's management menu, navigate to Certificates & secrets.

  2. Click + New client secret.

  3. Add a description and set an appropriate expiration.

  4. IMMEDIATELY COPY AND SECURELY STORE THE SECRET VALUE. You will not be able to retrieve it again. This is your Client Secret.

Step 3: Grant Application Permission and Admin Consent

You must grant the Client Application permission to use the custom scope defined in Part I.

  1. From the client's management menu, navigate to API permissions.

  2. Click + Add a permission.

  3. Select the My APIs tab.

  4. Select the DecisionRules Solver API Resource you created in Part I.

  5. Select Application permissions (for M2M/service-to-service calls).

  6. Expand the permission and check the box next to your custom scope: decisionrules:orgid:12b057b4-865b-4545-81c4-8899d1da3537:spaceid:8ba6bac9-08a8-e648-8a2c-0b3992a9b4d6:solver.

  7. Click Add permissions.

  8. Click the Grant admin consent for [Your Tenant] button and confirm. The Status must show "Granted".

Final Step: Requesting the Access Token

Your client application must now use its credentials and the .default scope to request an Access Token that includes the granted custom permission.

OAuth Parameter

Source Value

client_id

Client Application ID (from Part II, Step 1)

client_secret

Client Secret Value (from Part II, Step 2)

grant_type

client_credentials (Fixed value for M2M)

scope

example: api://cdc128ef-09ca-46ca-a349-57c0c248cad7/.default

Application ID URI (from Part I, Step 2) followed by /.default

Example Token Request:

Example Response:

Example Decoded JWT Token Data:

The resulting Access Token will be valid and contain the necessary roles (scope) claim, allowing the client to access the DecisionRules Solver API.

Last updated