Requesting a Vault Secret with a JWT

Obtain the Access Token

The calling application sends a POST request to the Microsoft Entra ID token endpoint for its tenant. It uses grant_type=client_credentials, its own Client ID, its own credential, and the scope <protected-resource-application-id-uri>/.default. Microsoft Entra ID returns access_token; this value is the signed JWT supplied to PAM.

Call the Existing AAPM Password Endpoint

The integration uses the existing GET endpoint /aioc-rest-web/rest/aapm/request/password. The workload continues to send the standard AAPM account parameters for the configured Vault Account. Instead of relying on a Kron token for authentication, it sends Authorization: Bearer <jwt>.