Akamai integration¶
Connect DXDT to Akamai via the {OPEN} APIs using EdgeGrid credentials from a read-only API client, so DXDT can query CDN delivery configs and security posture for SRE and FinOps insight.
| Setup time | ~15 minutes |
| Difficulty | Advanced |
Access required: Akamai Control Center access with permission to create API clients in Identity & Access Management, scoped to read-only authorizations.
Prerequisites¶
- An Akamai Control Center account.
- Permission to create an API client (Identity & Access Management → API clients).
- Knowledge of which contracts/groups you want DXDT to observe.
Setup¶
1. Open Identity & Access Management¶
In Akamai Control Center → Identity & Access Management → API clients, choose to create a new API client (Quick or Advanced). Advanced lets you scope APIs and authorizations precisely.
2. Scope the client to READ-ONLY APIs¶
Add only the API services DXDT needs (for example Property Manager / PAPI, Contracts-API, Application Security) and set each authorization to READ-ONLY. Do not grant READ-WRITE.
Note
Least privilege matters: DXDT only lists contracts, groups, properties, CP codes, and security configs — all read operations.
3. Create the client and copy the credentials¶
Complete creation to generate the EdgeGrid credential set. Copy all four values immediately.
- Host (base hostname, for example
akab-xxxx.luna.akamaiapis.net) →host - Client token (
akab-...) →client_token - Client secret →
client_secret - Access token (
akab-...) →access_token
4. Enter the configuration in DXDT¶
Open the akamai plugin and fill Host (host), Client Token (client_token), Client Secret (client_secret), and Access Token (access_token). If you are a partner or manage multiple accounts, also enter the optional Account Switch Key (account_switch_key); otherwise leave it blank.
Configuration fields¶
| Field | Where to find it |
|---|---|
Host (host) |
EdgeGrid credentials → the API base host (for example akab-xxxx.luna.akamaiapis.net). |
Client Token (client_token) |
EdgeGrid credentials → client token (akab-...). |
Client Secret (client_secret) |
EdgeGrid credentials → client secret (shown at creation). |
Access Token (access_token) |
EdgeGrid credentials → access token (akab-...). |
Account Switch Key (optional) (account_switch_key) |
Optional — for partners/multi-account access, the account switch key from Identity & Access Management. Leave blank for single-account setups. |
Verify the connection¶
After saving, open the plugin Status view (or run the ping command). A healthy connection validates the EdgeGrid signature and can list contracts without a 401.
Security
DXDT makes only read-only Akamai {OPEN} API calls with EdgeGrid auth. Create the API client with READ-ONLY authorizations and the narrowest API scope needed — never READ-WRITE. The client_secret and access_token are stored encrypted; rotate them per your policy.
Troubleshooting¶
401 Unauthorized / signature mismatch on ping
One of the four EdgeGrid values is wrong, or the host does not match the client's base hostname. Re-copy all four credentials from the API client, ensuring host is the exact base hostname (no https://) and no whitespace was included.
403 Forbidden on list properties/list security
The API client lacks authorization for that API service, or it is not scoped READ-ONLY for it. Edit the API client to add READ-ONLY authorization for the needed services (PAPI, App Security, Contracts-API).
Empty results when listing properties or CP codes
Missing contract=<id>/group=<id> context, or the client is scoped to a different group. Run list groups first to obtain contract and group IDs, and confirm the client's group assignment covers them.
Data from the wrong account (partners)
Missing or wrong account_switch_key. Set the correct account_switch_key for the managed account; remove it to target your own account.
Vendor documentation: https://techdocs.akamai.com/developer/docs/set-up-authentication-credentials