- A user account is associated with a person who wants to interact with CDF. Each user account has a user profile containing a unique user ID.
- A service account is associated with an application or process that interacts with CDF, such as an extractor or Cognite Functions, rather than a person.
Authentication for this API
Direct requests to the Principals API toauth.cognite.com, similar to organizations.
The Principals API accepts only OAuth tokens issued by https://auth.cognite.com (such as those issued when logging into Fusion).
You can also obtain a token by initiating a login flow against the authorization server directly. See the “Authorizations” sections for more information.
Retrieve principals
Retrieve service accounts by ID or external ID. Retrieve users by ID. You must be signed in to the organization, or be an admin of an ancestor.Login sessions
A login session is what a person receives after signing in to Fusion, InField, or another Cognite app. It is separate from a background session used by transformations or functions. Each background session is backed by a login session. Service accounts do not have login sessions. List and revoke require you to be an admin of that organization. Admin rights on an ancestor are not enough. Revoke sets the session toREVOKED. API requests that use an access token from that session fail, refresh fails, and background jobs started from that session stop. This can take up to one hour. Other login sessions for the same user stay active. To block the user, remove them from the identity provider, list their login sessions, and revoke those IDs. Send at most 10 IDs per request.
You can revoke a session that is LOGGED_OUT or EXPIRED. REVOKED stops background sessions. LOGGED_OUT does not. Revoking a session that is already REVOKED succeeds and does not change deactivatedTime. The call is atomic: any status other than 204 means no session in the request was revoked.