# Creating and Managing API Client in CrowdStrike's Console

## 1. Introduction

ClientId and ClientSecret are required in order to make requests using the OAuth2.0 workflow to CrowdStrike's API client.

## 2. Prerequisites

Before you begin, ensure you have:

- Access to the CrowdStrike Falcon Console
- Administrator privileges


## 3. Creating API Client

### Step 1: Access the CrowdStrike Falcon UI Console

- Log in to your CrowdStrike Console instance with administrative privileges.


### Step 2: Create an API Client, generate ClientId/ClientSecret with proper scope

- Go to the **Support and resources > Resources and tools > API Client and keys** section where an API Client can be managed.
- Create an API Client
- Provide a Client name and a related description with the following scope permissions:
#### Permissions Required:
| Scope | Read | Write | Purpose |
|  --- | --- | --- | --- |
| **Alerts** | ✅ | ❌ | Query alert data and threat/EDR events |
| **Hosts** | ✅ | ✅ | Query endpoint information and quarantine endpoints from network. Excluding the write permissions disables the quarantine feature. |
| **Assets** | ✅ | ❌ | Query application data |
| **IOC Management** | ✅ | ✅ | Query, create and delete Indicators of Compromise (IOC). Excluding the write permissions disables creating and deleting IOCs. |
| **Custom IOA Rules** | ✅ | ✅ | Query, create, and delete Custom IOA (behavioral detection) rules. Excluding write disables creating and deleting IOAs. Distinct from **IOC Management**. |
| **Zero Trust Assessment** | ✅ | ❌ | Query security posture scores |
| **Real Time Response** | ✅ | ✅ | Establish RTR sessions and retrieve files from hosts (`retrieve_file`). |
| **Real Time Response (Admin)** | ❌ | ✅ | Run scripts on hosts via `execute_remote_script` (RTR `runscript`). **Also requires enabling the command in the host's Response policy — see Section 5.** |
- Confirm the new API Client
- Securely store the generated Client ID, Secret and Base URL


## 4.  Configure the Integration

**URL**
This is the Base URL from where the Falcon API Client credentials came.
[CrowdStrike Base URLs](https://falcon.us-2.crowdstrike.com/documentation/page/a2a7fc0e/crowdstrike-oauth2-based-apis#k9578c40)

**ClientId**
This is the Client Id gathered in step 2

**ClientSecret**
This is the Client Secret gathered in step 2

***Note***
The token_url should not be set/configured when configuration the Integration.

## 5. Enable Real Time Response for Script Execution (Response Policy)

Running scripts on a host via `execute_remote_script` requires **two** independent
authorizations. The API scope from Section 3 (**Real Time Response (Admin)**) only permits the
API *call*; a separate **Response policy** on the host controls whether the command is allowed
to *run*. Without it, a script is accepted by the API but the host returns
`"runscript is disabled by policy"` and produces no output.

To enable it:

1. In the Falcon console, go to **Host setup and management → Response and containment → Response policies**.
2. Select the host's operating system from the dropdown (Windows, macOS, or Linux).
3. Open the Response policy assigned to the hosts you want to target (for most tenants this is
the platform default policy).
4. Enable the toggles for the capabilities you need, then **Save**:
  - **Real Time Response** (top-level) — must be enabled for any RTR activity.
  - **Custom scripts → Custom Scripts** — required for `execute_remote_script` (RTR `runscript`).
  - **High risk commands → get** — required for `retrieve_file` (usually enabled by default).


Policy changes take a short time to propagate to the endpoint before script execution succeeds.

> The Response policy applied to a given host is reported by the CrowdStrike device API under
`device_policies.remote_response.policy_id`.


## 6. Important Links in CrowdStrike's Documentation

- [CrowdStrike OAuth2-Based APIs](https://falcon.us-2.crowdstrike.com/documentation/page/a2a7fc0e/crowdstrike-oauth2-based-apis)