the page is not not public yet

1. Introduction

WMDA IT team creates applications for your organisation and provides the API Credentials (client_id and client_secret) needed to connect to WMDA APIs. Each application has a client_id (which is permanent) and requires client secrets to authenticate.

Client_id

• Created by the WMDA and shared with your organisation.
• Identifies your application connection to the WMDA APIs.
• Permanent - it does not expire and cannot be changed.
• Is permanent and does not change.

Client_secret

• A confidential credential linked to a specific client_id.
• Acts like a temporary password for machine-to-machine authentication.
• Required when requesting a bearer token to connect to the WMDA APIs.
• Expires after a set period. A replacement must be created and used.
• Can be managed by your organisation in the Self Service API Credentials Portal (see 4. Managing your client secrets below).

2. Applications in the Self Service API Credentials Portal:

The Self Service API Credentials Portal lists the applications created by the WMDA IT team for your organisation. Each application represents access to one or more APIs.

Examples of applications you may see in the Self Service API Credentials Portal:

• Partner-NL-OrganisationName-DM

• Partner-NL-OrganisationName-SMC

• PartnerAlternative-NL-OrganisationName-SMC (sandbox only)

Applications naming convention follows this pattern: Partner-(Country Code)-(Organisation Name)-(API). Where:

• Country Code: 2-letter ISO code for your country (e.g., NL).
• Organisation Name: your organisation name.
• API: The WMDA APIs the application has permission to access, e.g.:
  • DM (Data Manager).
  • SMC (Search, Match & Connect).

Depending on the API permissions assigned to your application, it may have access to the following WMDA resources: 

• Search and Match production;
• Search and Match sandbox;
• Match-Connect production;
• Match-Connect sandbox;
• Data Manager production;
• Data Manager sandbox;

Each application has its own client_id and client secrets. Visibility depends on your user role (see 3. Access to the Portal below) and the API permissions assigned to your application.

3. Access to the Self Service API Credentials Portal

You can manage client secrets using the Self Service API Credentials Portal, where you can view, create, and delete client secrets.

To access the portal:

1. You must have the appropriate user role (credential manager) provided by the WMDA team.
2. Login to the portal using MFA (MFA user guide).
3. Visit the page https://portal.wmda.info/manage-clients.

4. Managing your client secrets

As credential manager you can use the Self Service API Credentials Portal to:

• View the applications and their client_ids provided by the WMDA.
• Create new client secrets for these applications.
• See expiration date for each client secret.
• Delete client secrets.

To create a new secret:

1. Click on the "Create new secret" button and the pop-up will appear:

2. Provide client secret name and expiration date (1 year maximum) for this secret:

3. Click on "Create".

4. Client secret will appear:

Once a new client secret is in use, the old one should be removed to prevent unnecessary expiration reminders and confusion.

To delete a secret:

1. Click on the delete icon next to the secret you would like to delete and confirm your action:

5. Email Notifications About Expiring Client Secrets

The designated contact(s) (credential manager) for your organisation will automatically receive email notifications from WMDA when a client secret is approaching expiration.

Notifications are sent at the following intervals:

• 6 weeks before client secret expiration.
• 3 weeks before client secret expiration.
• 1 week before client secret expiration - daily reminders until the secret is replaced.

These reminders are sent only to users who have been granted access to the Self Service API Credentials Portal.