How to access Cloud Foundry Controller API?

[former_member184876]

Hi Community,

After working for quite some time on the Cloud Foundry CLI and SAP Cloud Platform Cockpit, i was thinking how to access Cloud Foundry using Cloud Foundry API.

I explored little bit, but have hard time to understand how to authenticate to CF API using postman.

https://api.cf.eu10.hana.ondemand.com/

Need your advice on how i can get access token to access different Cloud Foundry APIs form Postman?

Thank you in advance,

Venu

[vijendra_pachoriya]

Hi,
Did anyone found a solution for this ?

Best Regards,

Vijendra

[tobias_mitter2 · Accepted solution]

It seems there is no solution yet, but there is one coming.

See this: https://help.sap.com/viewer/65de2977205c403bbc107264b8eccf4b/Cloud/en-US/3670474a58c24ac2b082e76cbbd...

Just stumbled over it by accident. When I look at the supported scopes though, it seems it is only a part of the whole api. It doesn't even say which api (v2 or v3), it might even be that SAP is building a facade around it...have to check it out some time. Hope this helps.

[former_member184876 · Accepted solution]

Thank you Tobias for sharing this info. very helpful.

[mike_zaschka]

The answer is a copy from here: https://answers.sap.com/questions/13004003/how-to-authenticate-cloud-platform-api.html

With the help of SAP:

The CF Cloud Controller API is currently not connected to XSUAA and thus it is not possible to obtain a token from there. Instead you have to directly call the CF UAA service and use a valid user (no service key) and the following parameters. You should then get a valid token with cloud_controller.read and cloud_controller.write scopes.

Endpoint

https://login.cf.eu20.hana.ondemand.com/oauth/token (BTP region dependent)

Basic Authentication
user: cf
password: (empty - no password)

Parameters:

username: <BTP user email>
password: <BTP user password>
client_id: cf
grant_type: password
response_type: token

An example CURL call:

curl -v -XPOST -H"Application/json" -u "cf:" --data "username=<BTP user email>&password=<BTP user password>&client_id=cf&grant_type=password&response_type=token" https://login.cf.eu20.hana.ondemand.com/oauth/token

[marco_spyker]

Hi @mike_zaschka,
hi all  and a Happy New Year 2025!

We have been struggling with this topic, as well, with some “sleepless nights” and accidentally found this community post and we are very happy to say, that you have provided this information to us – thanks.

Now, with providing a valid user, configured in the BTP (email / password) we have managed to get valid access-tokens.

Because your answer here is 3 years old, maybe you (or some one else in here) can give information, if accessing the Cloud Foundry can be managed differently. If we rely on this approach, this would mean, we would need some kind of a technical user on the BTP platform and from security perspective, can we some avoid providing passwords in plain text?

Thanks a lot in advance,

M. Spyker

[gregorw]

Hi @marco_spyker ,

thank you for posting this follow up. I also wondered if there is a way to authenticate to the Cloud Foundry API using X.509 Client Certificates. And with the help of the Blog Post:

Automation with the btp and cf command-line interfaces: logging in with passcodes

I made it work and used the passcode retrieved from the Cloud Identity Service Endpoint "/service/users/passcode" instead of the Password (cf_password .env Variable) in my Example:

https://github.com/gregorwolf/bookshop-demo/blob/main/tests/cloud-foundry.http

With the following destination I'm able to retrieve the passcode:

I think I will build a CAP Plugin that uses this destination plus a destination to the CF API to simplify the access.

Best regars,
Gregor

[gregorw]

Maybe the links to the Cloud Foundry API documentation in SAP HANA XSA Controller API Interaction help you.

[pavithra]

Did anyone find an answer to the question to do it in complete REST way

[former_member210955]

Does this help ?

http://v3-apidocs.cloudfoundry.org/version/3.92.0/

Best Regards,

Saurav

[former_member210955]

Does this help ?

http://v3-apidocs.cloudfoundry.org/version/3.92.0/

Best Regards,

Saurav

[tobias_mitter2]

Hi Venu,

I had basically the same question a few days ago.

https://answers.sap.com/questions/13004003/how-to-authenticate-cloud-platform-api.html

Didn't get a response until now. You can get a token with cli and use it in postman to access the api. It works well, I can use the whole range of apis (http://v3-apidocs.cloudfoundry.org/version/3.81.0/index.html). It is just that I can not find a way to authenticate in a REST way (without CLI). So it is really frustrating.

Best regards,

Tobias

[former_member184876]

Hi Tobias,

Thanks for your response and pointing to your question. Yes. The token form CF CLI is working. But the JWT from XSUAA service instance (received through application binding) is rejected by Cloud Foundry API. Not sure if there is a way to access CF API through applicaitons.

Thank you,

Venu

[tobias_mitter2]

Yes I tried every conceivable way...

Until just recently we had the same problem with the XSUAA API. There was also no way to use it until SAP finally released a "fix". Now you can create a XSUAA Instance with a special api service plan. When creating a service key for that instance you could finally get a working client_id and client_secret to access the api. The CF documentation mentions one can use the CF UAA to get a token to use the plattform api and by using the access to XSUAA I tried to create a oauth client, but also didn't succeed. For the plattform api, you need specific authorizations (scopes) which xsuaa doesn't give you.

I just cannot image, why on earth we are the only ones who would like to use this api. It is absolutely necessary for an operation team.

[gregorw]

With your reminder for the service plan apiaccess I was able to find the documentation Enable API Access to an XSUAA Configuration.