Authentication - FlowForma

The FlowForma Governance API accepts two kinds of credential. Which one you use depends on the endpoint.

Azure AD bearer token

Used by most endpoints (environments, environment requests, processes, security templates, settings). Obtained from an Azure AD app registration.

Integration access token

Required by the Process Actions and API Connections endpoints. Copied from FlowForma Settings.

All requests are made against the base URL https://api.flowforma.com.

Azure AD bearer token

Most endpoints authenticate with an Azure AD app-only access token.

Create an app registration with the Sites.Read.All Microsoft Graph application permission and a client secret. Follow the App Registration guide. Note the Application (client) ID, Directory (tenant) ID, and client secret.

Request a token

Call the token endpoint with those three values as query parameters:

curl "https://api.flowforma.com/v1/oauthToken?appId=YOUR_CLIENT_ID&appSecret=YOUR_CLIENT_SECRET&tenantId=YOUR_TENANT_ID"

The response body is the access token.

Call the API

Send the token in the Authorization header using the Bearer scheme:

curl "https://api.flowforma.com/v1/environments" \
  -H "Authorization: Bearer YOUR_ACCESS_TOKEN"

The API resolves your tenant from the token, so no tenant identifier is needed on individual calls.

Integration access token

The Process Actions and API Connections endpoints require a FlowForma integration access token instead of a bearer token. If you send a bearer token to these endpoints, the request is rejected.

Copy the token

In your FlowForma environment, open FlowForma Settings and copy the integration access token.

Call the API

Send the token as the raw Authorization header value, with no Bearer prefix:

curl -X POST "https://api.flowforma.com/v1/processActions/createForm" \
  -H "Authorization: YOUR_INTEGRATION_ACCESS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{ "FlowFormaURL": "https://contoso.sharepoint.com/sites/flow", "FlowId": "12" }'

The integration access token is sent without the Bearer prefix. The Azure AD token is sent with it. Using the wrong one for an endpoint results in an error.

Azure AD bearer token

Integration access token

​Azure AD bearer token

​Integration access token

Azure AD bearer token

Integration access token