For AI agents: a documentation index is available at https://www.mongodb.com/docs/llms.txt — markdown versions of all pages are available by appending .md to any URL path.
Docs Menu
Docs Home
/ /
Get Started
Docs Home
/ /
Administration API
/
Get Started
Docs Home
/
Management
/
APIs
/
Administration API
/
Get Started

Manage Programmatic Access to an Organization

Use the following procedures to manage programmatic access to an organization. To learn more, see Grant Programmatic Access to an Organization.

Important

We recommend you use service accounts instead of API keys to authenticate to the Atlas Administration API. API keys are a legacy authentication method.

Required Access

To perform any of the following actions, you must have Organization Owner access to Atlas.

View Programmatic Access to an Organization

You can view the details of all service accounts or API keys that have access to your organization.

1

In Atlas, go to the Applications page.

  1. If it's not already displayed, select your desired organization from the Organizations menu in the navigation bar.

  2. Click Applications in the sidebar under the Identity & Access section.

The Applications page displays.

2

Click the Applications tab.

3

Click Service Accounts.

4

Click the name of a service account.

5

View the details of the service account.

The details include:

  • The obfuscated client secret for the service account

  • The date the client secret was last used

  • The date the client secret was created

  • The IP addresses from which the service account can access the API

  • The roles the service account has been assigned

You can use the Atlas Administration API to list the names and details of the service accounts that have access to your organization.

To view the details of an API key in an organization using the Atlas UI, follow these steps:

1

In Atlas, go to the Applications page.

  1. If it's not already displayed, select your desired organization from the Organizations menu in the navigation bar.

  2. Click Applications in the sidebar under the Identity & Access section.

The Applications page displays.

2

Click the Applications tab.

3

Click API Keys.

4

View the Access List.

  1. Click to the right of the API Key.

  2. Click View Details.

The <Public Key> API Key Details modal displays:

  • The obfuscated Private Key

  • The date the Key was last used

  • The date the Key was created

  • The IP addresses from which the Key can access the API

  • The projects to which the Key has been granted access

You can view a list of API keys, the details of an API key, or the access list for an API key in an organization using the Atlas CLI.

View API Keys

To list all API keys in an organization using the Atlas CLI, run the following command:

atlas organizations apiKeys list [options]

To return the details for an API key in an organization using the Atlas CLI, run the following command:

atlas organizations apiKeys describe <ID> [options]

To learn more about the syntax and parameters for the previous commands, see the Atlas CLI documentation for atlas organizations apiKeys list and atlas organizations apiKeys describe.

View API Access List Entries for the API Key

To list IP access list entries for your API key using the Atlas CLI, run the following command:

atlas organizations apiKeys accessLists list <apiKeyID> [options]

To learn more about the command syntax and parameters, see the Atlas CLI documentation for atlas organizations apiKeys accessLists list.

Update Programmatic Access to an Organization

You can change the roles, name, description, or access list for a service account in an organization using the Atlas UI. You can also generate a new client secret.

1

In Atlas, go to the Applications page.

  1. If it's not already displayed, select your desired organization from the Organizations menu in the navigation bar.

  2. Click Applications in the sidebar under the Identity & Access section.

The Applications page displays.

2

Click the Applications tab.

3

Click Service Accounts.

4

Click the name of a service account.

5

Edit the Service Account Info.

To modify the Name or Description, click .

6

Generate a new client secret.

  1. Click Generate New Client Secret

  2. Choose a duration for the client secret from the menu. The client secret expires after this duration.

  3. Click Generate New.

  4. Click Copy and save the client secret to a secure location. This is the only time you can view the full client secret.

7

Edit the Organization Permissions.

  1. Click Edit Permissions.

  2. From the Organization Permissions menu, select the new role or roles for the service account.

  3. Click Save and next.

    Important

    The service account credentials remain active until they expire or are revoked.

8

Edit the API Access List.

  1. To add an IP address or CIDR block from which you want Atlas to accept API requests for this service account, click Add Access List Entry and type an IP address.

    You can also click Use Current IP Address if the host you are using to access Atlas also will make API requests using this service account.

  2. To remove an IP address from the access list, click to the right of the IP address.

  3. Click Save.

You can use the Atlas Administration API to:

You can change the roles, description, or access list for an API Key in an organization using the Atlas UI.

1

In Atlas, go to the Applications page.

  1. If it's not already displayed, select your desired organization from the Organizations menu in the navigation bar.

  2. Click Applications in the sidebar under the Identity & Access section.

The Applications page displays.

2

Click the Applications tab.

3

Click API Keys.

4

From the ellipsis menu to the right of the API Key you want to change, click Edit.

5

Edit the API Key Information.

On the Add API Key page:

  1. Modify the Description.

  2. In the Organization Permissions menu, select the new role or roles for the API key.

6

Click Next.

7

Edit the API Access List.

  1. To add an IP address or CIDR block from which you want Atlas to accept API requests for this API Key, click Add Access list Entry and type an IP address.

    You can also click Use Current IP Address if the host you are using to access Atlas also will make API requests using this API Key.

  2. To remove an IP address from the access list, click to the right of the IP address.

  3. Click Save.

8

Click Done.

You can change the roles or access list for an API key in an organization using the Atlas CLI.

Change an API Key's Roles

To update an API key in an organization using the Atlas CLI, run the following command:

atlas organizations apiKeys assign <apiKeyId> [options]

To learn more about the command syntax and parameters, see the Atlas CLI documentation for atlas organizations apiKeys assign.

Add an API Access List Entry for the API Key

To create an IP access list entry for your API key using the Atlas CLI, run the following command:

atlas organizations apiKeys accessLists create [options]

To learn more about the command syntax and parameters, see the Atlas CLI documentation for atlas organizations apiKeys accessLists create.

Delete an API Access List Entry for the API Key

To delete an IP access list entry for your API key using the Atlas CLI, run the following command:

atlas organizations apiKeys accessLists delete <entry> [options]

To learn more about the command syntax and parameters, see the Atlas CLI documentation for atlas organizations apiKeys accessLists delete.

Revoke Programmatic Access to an Organization

To revoke programmatic access to an organization through the Atlas Administration API, you can delete any existing service accounts for that organization.

1

In Atlas, go to the Applications page.

  1. If it's not already displayed, select your desired organization from the Organizations menu in the navigation bar.

  2. Click Applications in the sidebar under the Identity & Access section.

The Applications page displays.

2

Click the Applications tab.

3

Click Service Accounts.

4

Delete the service account.

  1. Click the icon under Actions to the right of the service account you want to delete.

  2. Click Delete.

    Deleting a service account from an organization also removes it from from any projects to which the service account was granted access.

To revoke programmatic access to an organization through the Atlas Administration API, you can delete any existing service accounts for that organization.

You can use the Atlas Administration API to:

To revoke programmatic access to an organization through the Atlas Administration API, you can delete any existing API keys for that organization.

1

In Atlas, go to the Applications page.

  1. If it's not already displayed, select your desired organization from the Organizations menu in the navigation bar.

  2. Click Applications in the sidebar under the Identity & Access section.

The Applications page displays.

2

Click the Applications tab.

3

Click API Keys.

4

Click to the right of the API Key that you want to delete.

5

Click Delete to confirm that you want to delete this API Key or Cancel to leave the key in the Organization.

Removing an API Key from an Organization also removes that key from any projects to which the key was granted access.

To revoke programmatic access to an organization through the Atlas Administration API, you can delete any existing API keys for that organization.

To delete an API key from an organization using the Atlas CLI, run the following command:

atlas organizations apiKeys delete <ID> [options]

To learn more about the command syntax and parameters, see the Atlas CLI documentation for atlas organizations apiKeys delete.

To delete an access list entry for an API key in an organization, see Update Programmatic Access to an Organization.

Back
Get Started
Next
Multiple Organizations
Rate this page

On this page