Call the Nodinite Web API with Windows Authentication

When Nodinite uses Windows Authentication, the Web API accepts the Windows identity of the caller (Kerberos or NTLM). A script that runs as a domain user or service account doesn't need a token: the HTTP client negotiates authentication with IIS, and Nodinite grants access based on the Windows account or its Windows AD Groups and their Roles.

Use this guide when your Nodinite environment runs in Windows Authentication mode. When it runs in OpenID Connect / OAuth 2.0 mode, use Call the Web API with OAuth 2.0 Client Credentials instead.

Tip

The Web API is deterministic and ideal for scripts and pipelines. For natural-language questions about your integrations from VS Code or Claude Desktop, use the MCP Endpoint. See Web API or MCP Endpoint?.

Understanding Windows Authentication

The script runs as a Windows account. IIS authenticates it, and Nodinite maps the account, or a Windows AD Group it belongs to, to a Role.

Choose How the Script Authenticates

Tip

Run scheduled scripts as a dedicated service account, and give it a Role with only the permissions it needs. Every change it makes is recorded in Log Audits under that account.

Prerequisites

• Nodinite runs in Windows Authentication mode.
• The Windows account that runs the script is added as a User, or belongs to a Windows AD Group, with a suitable Role.
• You know the Web API base URL of your environment. The examples use <webapi-base-url>, for example https://nodinite.contoso.com:40001. The port is set for each environment in the Nodinite Portal (Servers step). To check it, add /scalar and open it in your browser. See Find the base URL.

Each example reads the Integrations in the Repository Model and prints the first Integration Id.

PowerShell

Use Invoke-RestMethod with -UseDefaultCredentials.

$nodiniteWebApiUrl = "<webapi-base-url>/api"

$getResponse = Invoke-RestMethod -Uri "$nodiniteWebApiUrl/integrations" -Method Get -UseDefaultCredentials
$getResponse.Collection.Items[0].Data.IntegrationId

Example: Retrieve the first Integration Id with the current Windows identity.

Python

Python on Windows

requests-negotiate-sspi uses the Windows SSPI interface and the current Windows identity. Install the dependencies first: pip install requests requests-negotiate-sspi.

import requests
from requests_negotiate_sspi import HttpNegotiateAuth

url = "<webapi-base-url>/api/integrations"

# Uses the current Windows identity (Kerberos/NTLM negotiation)
response = requests.get(url, auth=HttpNegotiateAuth(), timeout=30)
response.raise_for_status()

print(response.json()["Collection"]["Items"][0]["Data"]["IntegrationId"])

Example: Retrieve the first Integration Id with the current Windows identity.

Python on Linux

SSPI isn't available outside Windows, but NTLM works cross-platform with a username and password. Install the dependencies first: pip install requests requests-ntlm.

import os
import requests
from requests_ntlm import HttpNtlmAuth

url = "<webapi-base-url>/api/integrations"

# Read credentials from environment variables - never hardcode secrets
username = os.environ["NODINITE_USERNAME"]  # e.g. "DOMAIN\\serviceaccount"
password = os.environ["NODINITE_PASSWORD"]

response = requests.get(url, auth=HttpNtlmAuth(username, password), timeout=30)
response.raise_for_status()

print(response.json()["Collection"]["Items"][0]["Data"]["IntegrationId"])

Example: Retrieve the first Integration Id from a Linux host with NTLM.

Tip

For pipelines on Linux or in containers, OAuth 2.0 client credentials avoids Windows passwords altogether, if your environment runs in OAuth mode. See Call the Web API with OAuth 2.0 Client Credentials.

C#

HttpClientHandler with UseDefaultCredentials sends the current Windows identity.

using System.Text.Json;

using var handler = new HttpClientHandler { UseDefaultCredentials = true };
using var http = new HttpClient(handler) { BaseAddress = new Uri("<webapi-base-url>/") };

var json = await http.GetStringAsync("api/integrations");
using var doc = JsonDocument.Parse(json);

var firstIntegration = doc.RootElement
    .GetProperty("Collection").GetProperty("Items")[0]
    .GetProperty("Data").GetProperty("IntegrationId");
Console.WriteLine(firstIntegration);

Example: Retrieve the first Integration Id with the current Windows identity.

Node.js

This example uses httpntlm. Run npm install httpntlm first.

const httpntlm = require('httpntlm');

httpntlm.get({
  url: '<webapi-base-url>/api/integrations',
  username: process.env.NODINITE_USERNAME,
  password: process.env.NODINITE_PASSWORD,
  domain: process.env.NODINITE_DOMAIN
}, (err, res) => {
  if (err) return console.error(err);

  const jsonBody = JSON.parse(res.body);
  console.log(`First Integration Id: ${jsonBody.Collection.Items[0].Data.IntegrationId}`);
});

Example: Retrieve the first Integration Id with explicit Windows credentials.

Important

Read passwords from environment variables or a secret store, never from source code. For extra protection, use the Pre-Encrypt password feature.

Troubleshooting

Next Steps

• Manage the Web API
• Web API Scenarios
• Roles

Related Topics

• Call the Web API with OAuth 2.0 Client Credentials
• Windows AD Groups
• MCP Endpoint
• AI in Nodinite
• Log Audits