## Using OAuth with Symantec Endpoint Protection Manager web services

Symantec's implementation of the OAuth 2.0 protocol requires an administrator account on the Symantec Endpoint Protection Manager server. This account must be a Symantec Endpoint Protection Manager account. Authentication with an LDAP/Active Directory server account is not supported.

You may find it simpler to get started with OAuth and Symantec Endpoint Protection Manager web services by running the sample PowerShell scripts that are provided in the SDK. See Using the sample PowerShell scripts.

The following steps provide a high-level view of the process that is required to authenticate calls to web services.

Table:

Procedure | Who performs it | When it's performed
--- | --- | ---
Register the remote managment application with Symantec Endpoint Protection Manager, and provide the registration information to the remote management application | A Symantec Endpoint Protection Manager administrator | One time only, when Symantec Endpoint Protection Manager and the remote management application are first set up. See Registering an application with Symantec Endpoint Protection Manager.
Authorize the application to access Endpoint Protection web services Also called user consent. | Each Symantec Endpoint Protection Manager administrator who runs the remote management application | When the remote administrator first accesses the web service calls in the remote management application. Also required if the Endpoint Protection administrator account changes, or if the access token cache is cleared. See Authorizing an application to call Symantec Endpoint Protection Manager web services.
Exchange the authorization code that was obtained in the previous step for an access token | The remote management application | After the remote administrator authorizes the application. See Getting an OAuth access token from the authorization code.
Include the access token in every web service call that is made during the session | The remote management application | Whenever the application makes a web services call. See Including the OAuth token in calls to web services.
Refresh the access token when it expires | The remote management application | Whenever the access token expires. See Refreshing the access token.

See OAuth flow.

See OAuth implementation reference.

See Authenticating calls to Symantec Endpoint Protection Manager web services.

See Creating a web services client application.