FOR WHOEVER APPROVES THE INTEGRATION
Your directory. Your rights. Your cloud.
App callers bring a token from your own Entra or B2C directory. The rules you set in the API Manager decide what they reach, judged on the rights their access cards give, on every call. App secrets sit in your own Key Vault.
New to OpenX? Key terms →
ONE CALL · WHAT IS CHECKED
- Token
- RS256, from your own directory
- Claims
- Issuer, audience, expiry, an admitted client
- Rights
- From your access cards, never the token
- Keys
- Not stored; a revoked key fails its next call
- access/me
- What this caller may do, from the server
Your directory decides who. Your rules decide what.
WHAT HAPPENS ON EVERY CALL
Checked on the server, every time.
Tokens checked strictly
RS256 only, the exact issuer from your directory, the right audience, an expiry, and a client the workspace admits.
Rules you set, rights from your cards
What an app caller reaches is decided by your API Manager rules, per API, tab or endpoint, judged on rights from your access cards on the server, never from claims in the token. An app is never treated as an owner.
Keys that expire
Presets from 5 minutes to 24 hours, or a custom lifetime up to 90 days. The server caps every key at 90 days.
Keys we never keep
Keys are signed tokens, so the server checks the signature. It stores only each key's id, owner and dates, never the key, and a revoked key fails its next call.
App secrets in your vault
Connected apps' keys are made by OpenX and written straight to your Key Vault. Nobody pastes them in.
Ask before you call
access/me returns a caller's rights and configurations, worked out on the server from your cards.
IF YOU ARE THE ONE ASKED TO APPROVE IT
For the people who say yes to an integration.
Security reviewers
App access tied to your own directory, with rights you can read in one place.
Identity teams
Your Entra or B2C tenant stays the source of who a caller is.
Platform owners
One door to review for every capability, instead of one per service.
INSTEAD OF A GATEWAY REVIEW
One door to review, not one per capability.
Warm queries, data stores and licences all publish their routes through the same workspace API, under the same token checks and the same API Manager rules.
- Revoking a job identity removes the credential OpenX made, at once.
- An AI over MCP reaches only read-only routes, within the rights of the person who signed it in.
- Jobs get their own identities, with no password-style secret to rotate.
WHAT A REVIEW LOOKS LIKE
From a request to an approved caller.
Partner access
- 01The partner's app signs in through your directory.
- 02Your API Manager rules name the routes it may reach.
- 03Everything else is refused.
A nightly job
- 01The job gets its own identity, with a certificate.
- 02Its token is checked like any app caller.
- 03Revoke it, and it stops.
A key that got out
- 01An API key turns up somewhere it should not.
- 02You revoke it.
- 03Its next call is refused.
WHO CALLS THE API
Callers you can account for.
LIFE SCIENCES
Lab and QA apps reach only the routes your API Manager rules allow them.
MANUFACTURING
MES and dashboard integrations, each with its own identity and rights.
ENERGY AND BUILDINGS
Billing and tenant apps reading meter queries under their own cards.
Review it once. Approve with confidence.
Set up your directory in App Identity, then decide who reaches what.
MORE OF OPENX
AI governance →
Over MCP, AI proposes and a person accepts. Only a person deploys.
OpenX MCP Server →
A few tools let any MCP-capable AI read your workspace and propose changes to it.
API Manager →
Your workspace is already an API. Decide who may call it and what each caller reaches.
Warm queries →
Save a question over live data and serve the answer to dashboards, apps and AI.
Provenance →
A record you can prove, kept in your own cloud, with corrections and signatures.
Your cloud →
Connect your Azure, build the landing zone, and the rest of OpenX runs inside it.
Databases →
A Cosmos DB store in your subscription, with a governed API for each container.
App Identity →
Your own sign-in directory, identities for your jobs, and access in one window.
Licenses →
Sell what you build on your own Stripe, and turn a subscription into a plan's rights.
IoT →
IoT Hub and Data Explorer in your Azure, feeding queries, APIs and AI.
Communications →
Send mail through your own relay, with the password in your vault and sends on record.
App building →
Data, sign-in, access, an API and billing: your app's backend, already there.