Configure the MES WEB API to use a service-to-service access token

If a workflow is being triggered automatically from a background task or service, such as Scheduler or FileWatcher, then service‑to‑service security must be configured. This configuration entails setting the authentication mode for the MES Web API that is being used to Service to Service Access Token.

So, if an MES model-driven workflow requires background association, you must create a new MES Web API definition that uses the service‑to‑service access token and then link all of the MES activities to use that MES Web API definition.

For service-to-service, the MES middleware uses the default background user configured for the User ID for background tasks system attribute (configured in MES Client; attr_id 199 in the System_Attr table). The default entry for this system attribute is Default Background User. If the default background user is changed, make sure that the new user is a valid, active MES user (MES users are configured using MES Client). Note that MES Web API caches the default background user. So changing the default background user requires either restarting the MES middleware to make the change effective immediately or waiting for up to an hour for the middleware to be updated automatically with it.

To configure the MES WEB API to use a service-to-service access token

1. In Enterprise Console, open the Web API List page (click Settings, then click Web API).

2. Click New.

   

3. On the Web API List Item page, enter values for the following properties:

   • Name The name of the list item (e.g., MESWebAPI).

   • Description A description of the list item.

   • Source Select Generic.

   • Base Address The base URI for the MES Web API, which has the format https://hostname/mesmw/. Make sure that you include the forward slash (/) at the end of the URI.

   • Request (URI) Enter api.

   • Authentication Mode Select Service to Service Access Token.

   • Authority Enter the URL endpoint for the token authority. For how to obtain this endpoint, see Obtain the URL endpoints for the token authority and audience.

   • Audience Enter the URL endpoint for the token audience. For how to obtain this endpoint, see Obtain the URL endpoints for the token authority and audience.

   • Client ID Enter an AIM client ID. For how to create client IDs, see Create Client IDs to obtain AIM access tokens.

   • Client Secret Enter the AIM client password.

   • Scope Enter system.

4. Click Save to save your entries.

Now you can add a Web API lookup within a grid in a work flow form or for other functionality for which lookups are supported. See Add a Web API lookup for an MES Web API endpoint.