This guide contains details for configuring your usage of State Street API. If you are looking for a basic demonstration, consult Get Started documentation for a step-by-step walkthrough.

Authentication and Authorization for State Street API follows an OAuth 2.0 Client Credentials flow, as described in RFC 6749.

Register an Application to generate OAuth 2.0 Client Credentials.

Once registered, you may retrieve the Client Identifier and Client Secret used to request the Access Token and invoke State Street API.

1. Login to State Street Developer Portal
2. View your exisitng Application registrations at My Apps
   • Click "Add App"
3. Configure your new Application
   • Enter a descriptive title in "App Name" field
   • Select the services you need to enable with for your application in "API Catalogs". You must select at least one service.
   • Click "Add App"
   • A green "COMPLETE" message will briefly appear at the top of the page

You may modify the services allowed for an existing Application. Modification of the services enabled for an Application updates the "Last Updated" date, but does not change the "Created", "Issued", or "Expires" dates.

1. Login to State Street Developer Portal
2. View your exisitng Application registrations at My Apps
   • Identify on the Application you wish to edit and click "View Details"
3. Click "Edit" at the top of the page for your Application
   • Select the services you need to enable with for your application in "API Catalogs"
   • Click "Save"
   • A green "COMPLETE" message will briefly appear at the top of the page

Once you have successfully registered your Application, OAuth 2.0 Client Credentials are generated and made available for download on-demand in State Street Developer Portal.

1. Login to State Street Developer Portal
2. View your exisitng Application registrations at My Apps
   • Identify on the Application you wish to edit and click "View Details"
3. Within "Credentials" section, you may view and copy OAuth 2.0 Client Credentials:
   • Client Identifier, in the "Consumer Key" field
   • Client Secret, in the "Consumer Secret" field

To access State Street API, you will need to request a Access Token using your OAuth 2.0 Client Credentials. This process follows RFC 6749, Section 4.4.2.

As an example, an Access Token may be obtained and used to invoke Sample Transactions with cURL:

• Client Identifier: example_id
• Client Secret: example_secret

$ curl \
    --request "POST" \
    --header  "Accept: application/json" \
    --user    "example_id:example_secret" \
    --data    "grant_type=client_credentials" \
    --url     "https://api.statestreet.com/oauth/accesstoken"
{
    "access_token":"obAPdUGVlb8RCIQT7c7WR6P9zzzz",
    "scope":"read",
    "application_name": "65c652fe-2c5b-41d7-95ef-67fde1cd0000",
    "expires_in":"1799",
    "refresh_count" :"0",
    "status":"approved",
    "token_type":"Bearer"
}

$ curl \
    --request       "GET" \
    --header        "Accept: application/json" \
    --oauth2-bearer "obAPdUGVlb8RCIQT7c7WR6P9zzzz" \
    --url           "https://api.statestreet.com/sampleTransactions/v1/transactions"

By deafult, Application registrations expire after one year. The expiration date for an Application is available on the details page for the Application, available in My Apps. As the expiration for your Application approaches, you will need to register another Application to generate new OAuth 2.0 Client Credentials.

Multiple Application registrations for the same services may exist concurrently, and users are advised to register new Applications in advance of expiration.

You will receive notifications via email in advance of Application expiration.

For support, email api-support@statestreet.com, call a Helpdesk, or engage your Client Service Manager.