Administrator management of user authentication settings#

These endpoints allow an administrator to query or update the authentication settings for a user.
Generally, managing other users settings require the POWER-USER role, however some operations require additional permissions.

API-key management#

These endpoints allow an administrator to manage a users API-keys.

Managing API-keys requires security level default or above.
External users are therefore not allowed to manage API-keys using API-keys.
To manage API-keys via scripts, either use 2FA script authentication, or per-request cryptographic authentication.

Listing a users API-keys#

List active API-keys using:

curl -XGET -H"Argus-API-Key: my/api/key"

Creating a new API-key#

To create a new API-key:

curl -XPOST -H"Argus-API-Key: my/api/key" -d
  "description": "My read-only case API-key",
  "validSources": "",
  "expirationDays": 30,
  "sessionConstraints": {
    "function": [

Always restrict your api-keys as much as possible, to reduce the risk of misuse.

A key can be constrained by time, source IP, function/role constraints, and customer constraints.

If you only intend to use the key for a very limited set of features, you should limit the key to a suitable role.

If in doubt of which role to use, please contact

Deleting an existing API-key#

To delete an existing API-key, use the prefix of the key to identify the key.
E.g. for the prefix (userID/keyID) 15a6/1; delete the key by:

curl -XDELETE -H"Argus-API-Key: my/api/key"

OpenID user configuration management#

Please see External Identity Provider Integration Guide for details

Cryptographic key management#

A user may have enrolled one or multiple public keys, and use the corresponding private key to authenticate a session, or to sign requests.

For a user to enroll new keys, the user must be logged in with a higher security level, and this is not available for normal users to do via API-keys.
This is therefore not covered by this guide.

However, administrators may manage a users keys:

List a users cryptographic keys#

curl -XGET -H"Argus-API-Key: my/api/key"

Evict a users cryptographic key replay cache#

To avoid replay attacks using cryptographic signatures, Argus contains a short-lived replay protection cache, backed by a clock skew detection,
disallowing users to skew their clock to circumvent the replay protection cache.

In a situation where the clients clock is abruptly adjusted, the clock skew detection may prevent a client from authenticating requests until the clock skew cache has timed out. To resolve this situation, delete the “signature session” for the user:

curl -XDELETE -H"Argus-API-Key: my/api/key"

Authentication settings for other methods#

There are endpoints for SMS, Radius, LDAP and TOTP user management. However, these are not useful to integrate via scripts, and are therefore not documented in this guide.