How to access Cloud Foundry Controller API?

[former_member184876]

Hi Community,

After working for quite some time on the Cloud Foundry CLI and SAP Cloud Platform Cockpit, i was thinking how to access Cloud Foundry using Cloud Foundry API.

I explored little bit, but have hard time to understand how to authenticate to CF API using postman.

https://api.cf.eu10.hana.ondemand.com/

Need your advice on how i can get access token to access different Cloud Foundry APIs form Postman?

Thank you in advance,

Venu

[vijendra_pachoriya]

Hi,
Did anyone found a solution for this ?

Best Regards,

Vijendra

[mike_zaschka]

The answer is a copy from here: https://answers.sap.com/questions/13004003/how-to-authenticate-cloud-platform-api.html

With the help of SAP:

The CF Cloud Controller API is currently not connected to XSUAA and thus it is not possible to obtain a token from there. Instead you have to directly call the CF UAA service and use a valid user (no service key) and the following parameters. You should then get a valid token with cloud_controller.read and cloud_controller.write scopes.

Endpoint

https://login.cf.eu20.hana.ondemand.com/oauth/token (BTP region dependent)

Basic Authentication
user: cf
password: (empty - no password)

Parameters:

username: <BTP user email>
password: <BTP user password>
client_id: cf
grant_type: password
response_type: token

An example CURL call:

curl -v -XPOST -H"Application/json" -u "cf:" --data "username=<BTP user email>&password=<BTP user password>&client_id=cf&grant_type=password&response_type=token" https://login.cf.eu20.hana.ondemand.com/oauth/token

[marco_spyker]

Hi @mike_zaschka,
hi all  and a Happy New Year 2025!

We have been struggling with this topic, as well, with some “sleepless nights” and accidentally found this community post and we are very happy to say, that you have provided this information to us – thanks.

Now, with providing a valid user, configured in the BTP (email / password) we have managed to get valid access-tokens.

Because your answer here is 3 years old, maybe you (or some one else in here) can give information, if accessing the Cloud Foundry can be managed differently. If we rely on this approach, this would mean, we would need some kind of a technical user on the BTP platform and from security perspective, can we some avoid providing passwords in plain text?

Thanks a lot in advance,

M. Spyker

[gregorw]

Hi @marco_spyker ,

thank you for posting this follow up. I also wondered if there is a way to authenticate to the Cloud Foundry API using X.509 Client Certificates. And with the help of the Blog Post:

Automation with the btp and cf command-line interfaces: logging in with passcodes

I made it work and used the passcode retrieved from the Cloud Identity Service Endpoint "/service/users/passcode" instead of the Password (cf_password .env Variable) in my Example:

https://github.com/gregorwolf/bookshop-demo/blob/main/tests/cloud-foundry.http

With the following destination I'm able to retrieve the passcode:

I think I will build a CAP Plugin that uses this destination plus a destination to the CF API to simplify the access.

Best regars,
Gregor