## Authorizing an application to call Symantec Endpoint Protection Manager web services

Every administrator who manages Symantec Endpoint Protection Manager by using web services must authorize the web services client application to make web service calls on their behalf. This procedure is also called user consent.

Note: | The application must first be registered with Symantec Endpoint Protection Manager. For authorization, each remote management administrator account should map to a single Symantec Endpoint Protection Manager administrator account. A Symantec Endpoint Protection Manager administrator is always logged on to a single Symantec Endpoint Protection Manager domain at a time, even if the administrator has access rights to multiple domains.

Authorization represents the first authentication handshake between the remote management application and Symantec Endpoint Protection Manager.This procedure returns an authorization code that is then exchanged by the remote application for the access token that must be included with each web service call. An access token is associated with a single Symantec Endpoint Protection Manager administrator account and should not be shared. In other words, authorization is per user, not per application.

An administrator must re-authorize whenever a password or any other account information is changed, including access rights. A web services client application can avoid some re-authorization requests if the refresh token is used to obtain a new access token. See Refreshing the access token.

To authorize an application to call Endpoint Protection web services

1. The administrator is presented with a browser window that points to the following URL. The client application constructs the URL from the information that was returned during registration.

   https://hostname:port_number​/sepm/oauth/authorize?response_type=code&​client_id=client_id&​redirect_uri=https://hostname:port_number/sepm

   where hostname and port_number are the IP address or hostname and web services port of the installed instance of Symantec Endpoint Protection Manager, and where client_id is the client ID that was provided when the application was registered.

2. The administrator logs on to the specified Symantec Endpoint Protection Manager and authorizes the application to call the web services.

An authorization code is returned in the request response, and is then exchanged for an access token.

See Getting an OAuth access token from the authorization code.

The rest of the process to authenticate web service calls is performed by the remote management application without further intervention by the user of the application.

See Using OAuth with Symantec Endpoint Protection Manager web services.