# Using the OpenAPI console

Signing in, browsing endpoints and the try-it client - the console for API consumers.

The OpenAPI console is a web application where you sign in with your API credentials and see the APIs those credentials can invoke. It shows live documentation - endpoints, request and response schemas, examples - together with a try-it client that invokes the real APIs. The documentation is generated from the services actually deployed on the platform, so what you read always matches what runs.

You need two things to use it, both issued by the administrators of your environment:

- The console's address
- Credentials

## Sign in {#sign-in}

Opening the console's address in a browser displays the sign-in page. Which values go into the form depends on the kind of credentials you received:

| Credential type | Username field | Password field |
| --- | --- | --- |
| Username and password ([Basic Auth](https://zato.io/docs/security/basic-auth.html)) | Your username | Your password |
| [API key](https://zato.io/docs/security/api-keys.html) | The key's name | The key itself |
| [Bearer token](https://zato.io/docs/security/bearer-tokens/index.html) | Your client ID | Your client secret |

If your organization uses Microsoft Entra ID and your admins enabled it for the console, a "Sign in with Microsoft" button appears above the form and you can use your Microsoft account instead.

With wrong credentials, the sign-in page shows only an error message - no API details are visible before a successful sign-in.

## What you see and why {#what-you-see-and-why}

The document you receive after signing in contains only the endpoints your credentials can invoke. The filtering takes place on the platform's servers before anything reaches your browser, and other callers' endpoints are never sent to you.

If an endpoint you expect is missing from your view, your credentials do not grant it - ask your admins to check what your account has been assigned.

## Try endpoints out {#try-endpoints-out}

Every endpoint in the console has a try-it client. It sends a real request to the actual API, using the credentials you signed in with - the same permissions apply as when you call the endpoint directly from your own code. Fill in the request body based on the schema shown and the response comes back with its status code, headers and body.

## Connect your own tools {#connect-your-own-tools}

The document behind the console is a standard OpenAPI 3.1 specification, available in two formats under the console's address:

```text
/openapi/console/openapi.json
/openapi/console/openapi.yaml
```

Paste either URL into Postman, an API gateway, a code generator or any other tool that supports OpenAPI, and authenticate with the same credentials you sign in with. The document is always current - it is regenerated whenever the services behind it change, so there is no stale export to refresh.

## Call the APIs from your code {#call-the-apis-from-your-code}

The URL, HTTP method and schemas shown for each endpoint are the live contract of that API. A minimal call with curl, using Basic Auth credentials:

```bash
curl -u myuser:mypassword https://api.example.com/api/customer/get -d '{"customer_id":"123"}'
```

For anything larger, generate a client from the spec URL above - the generated code stays correct for as long as the contract shown in the console does not change, and the platform's administrators are notified of contract changes whenever the APIs are redeployed.

## Sign out {#sign-out}

Use the logout link in the console. Your session ends and the sign-in page appears again - the spec URLs also stop responding for your session until you sign in once more.

## For administrators {#for-administrators}

If you run the platform yourself, the [OpenAPI administration](https://zato.io/docs/dev/api-management/openapi.html) page covers the console's architecture, which channels are documented, branding and ports.

## See also {#see-also}

- [OpenAPI specifications](https://zato.io/docs/dev/rest/openapi.html) - Downloadable specification files and the HTTP endpoint
- [Authentication](https://zato.io/docs/dev/rest/authentication.html) - The credentials that sign you in to the console
- [API versioning](https://zato.io/docs/dev/rest/versioning.html) - The deprecation badges and sunset dates the console shows

## Learn more {#learn-more}

- [REST integration overview](https://zato.io/integrations/rest/) - Start here to see how teams build REST integrations
- [In-depth API tutorial](https://zato.io/tutorials/main/01.html) - Master architectural patterns for production-ready integrations
- [Modern REST API tutorial](https://zato.io/tutorials/rest-api/python.html) - Design, build and secure REST APIs with Python