## Authenticating calls to Symantec Endpoint Protection Manager web services

TheSymantec Endpoint Protection Manager web services use the OAuth 2.0 protocol for authentication. OAuth 2.0 provides a simplified authorization protocol that relies on SSL for security, instead of on direct cryptographic signing. OAuth lets Symantec protect the Symantec Endpoint Protection Manager administrator account credentials without delegating this responsibility to a third-party web service client application. The third-party application never has access to the administrator credentials.

OAuth provides a series of handshakes between a remote management application and an installed instance of Symantec Endpoint Protection Manager. Different actors perform these handshakes. The remote application administrator registers the application with Symantec Endpoint Protection Manager in a one-time-only procedure. Each Symantec Endpoint Protection Manager administrator who will run the web service client application then authorizes the client application to access the web services. Finally, the client application includes an access token with every web service call. A refresh token is provided with the access token so that the administrator does not need to repeat the authorization step under normal circumstances.

See Using OAuth with Symantec Endpoint Protection Manager web services.

More Information

OAuth flow