Note: The terms Project ID and Group ID are interchangeable.

Atlas App Services Admin API endpoints frequently require you to include two parameters in the URL:

• Your Atlas Project ID (also sometimes called a Group ID)
• Your App Services Application ID

Project ID

You can find your Project ID from the MongoDB Atlas dashboard or with the MongoDB Atlas CLI.

Application ID

To find an Application ID, make a request to the List Apps endpoint for your project. You'll need an access_token to make this request. To learn how to get one, see Get an Admin API Session Access Token.

curl --request GET \
  --header 'Authorization: Bearer <access_token>' \
  https://services.cloud.mongodb.com/api/admin/v3.0/groups/{groupId}/apps

This will return a list of objects describing each App Services App in the provided project/group. For Admin API requests, your Application ID is the ObjectId value in the _id field, not the client_app_id.

[
  {
    "_id": "5997529e46224c6e42gb6dd9",
    "group_id": "57879f6cc4b32dbe440bb8c5",
    "domain_id": "5886619e46124e4c42fb5dd8",
    "client_app_id": "myapp-abcde",
    "name": "myapp",
    "location": "US-VA",
    "deployment_model": "GLOBAL",
    "last_used": 1615153544,
    "last_modified": 0,
    "product": "standard",
    "environment": ""
  }
]

Every request to the App Services Admin API must include a valid, unexpired access token issued by the MongoDB Cloud API. You include this token in the Authorization header of each request using the bearer auth scheme.

You need a valid MongoDB Atlas programmatic API key for MongoDB Atlas to get a token.

Once you have an API key pair, call the authentication endpoint:

curl --request POST \
  --header 'Content-Type: application/json' \
  --header 'Accept: application/json' \
  --data '{"username": "<Public API Key>", "apiKey": "<Private API Key>"}' \
  https://services.cloud.mongodb.com/api/admin/v3.0/auth/providers/mongodb-cloud/login

If authentication succeeds, App Services returns an access token as part of the JSON response document:

{
  "access_token": "<access_token>",
  "refresh_token": "<refresh_token>",
  "user_id": "<user_id>",
  "device_id": "<device_id>"
}

The access_token represents a limited-time authorization to interact with the Admin API. To authenticate a request, include the token in a Bearer token Authorization header.

Authorization: Bearer <access_token>

Session access tokens expire 30 minutes after they are issued. When you login, the response also includes a refresh_token that you can use to get a new access token. This is useful because you only need to log in with credentials one time. After that you can use the refresh token to re-authenticate for as long as its valid.

By default, refresh tokens expire 60 days after being issued. You can customize refresh token expiration for a minimum of 30 minutes or a maximum of 5 years.

To refresh your authentication and get a new access_token, call the auth session endpoint with your refresh_token in the Authorization header:

curl --request POST \
  --header 'Authorization: Bearer <refresh_token>' \
  https://services.cloud.mongodb.com/api/admin/v3.0/auth/session

If the refresh token is valid, the response body includes a new access_token that's valid for the next 30 minutes:

{
  "access_token": "<access_token>"
}

Log in and adminstrate App Services Apps.

View and manage API keys through the API Key provider.

View and manage applications in an Atlas project.

View and manage authentication providers.