Management automation

Use ManagementClient only for tenant administration with a Service Account. It exchanges the server-side Service Account secret for a short-lived, permission-bounded management token using client_secret_basic; it cannot invoke MCP or inherit User authority.

TypeScript

import { ManagementClient } from "@axec/sdk/management";

const management = new ManagementClient({
  baseUrl: "https://axec.example",
  tenant: "acme",
  clientId: process.env.AXEC_SERVICE_ACCOUNT_ID!,
  clientSecret: process.env.AXEC_SERVICE_ACCOUNT_SECRET!,
  permissions: ["applications:read"],
});

const { applications } = await management.tenantApi().applications();

Python

import os

from axec_sdk import ManagementClient

async with ManagementClient(
    base_url="https://axec.example",
    tenant="acme",
    client_id=os.environ["AXEC_SERVICE_ACCOUNT_ID"],
    client_secret=os.environ["AXEC_SERVICE_ACCOUNT_SECRET"],
    permissions=("applications:read",),
) as management:
    applications = await management.tenant_api().applications()

Request only permissions needed for the task. Axec rejects a permission request that exceeds the Service Account ceiling. Both clients cache the short-lived management bearer and refresh it before expiry; refresh after credential rotation and keep the long-lived credential and bearer server-side.

The management interface provides tenant inventory and lifecycle operations, including Applications, Connectors, attachments, Connections, Service Accounts, and security activity. Treat one-time issued Service Account credentials as secrets: move them directly to secret storage, never logs or serialized state.

See Automate management with a Service Account for least privilege, rotation, immediate restriction, and evidence verification.

Continue

• Review Service Account lifecycle before issuing or rotating credentials.
• Review Evidence and auditing to understand the secret-free management evidence boundary.
• Autonomous gateway access when the next workload needs MCP capability invocation rather than tenant administration.