Chapter 6. MantisBT REST API
The primary means of integrating with MantisBT with web services is with the bundled REST API, which is accessible at https://server.com/mantis/api/rest/.
REST API calls can be authenticated using one of the following methods:
- API Token
The primary authentication method. Create an API token for your user account and pass it in the Authorization HTTP request header using the RFC 6750 bearer scheme (Authorization: Bearer <token>). The bare token form (Authorization: <token>) is also accepted for backwards compatibility. API token authentication is required when using impersonation.
When a request requires authentication but none is provided (and anonymous access is not available), the API responds with 401 Unauthorized and a WWW-Authenticate: Bearer header advertising the expected scheme.
- Anonymous
When anonymous access is enabled and an anonymous account is configured, the API can be accessed without authentication for read-only operations.
- Cookie (Web UI)
Used internally by the MantisBT Web UI when JavaScript calls the API on behalf of an already authenticated user session.
