> For the complete MongoDB documentation index, see www.mongodb.com/docs/llms.txt # AtlasGov Programmatic Access ## Introduction to Programmatic Usage MongoDB Atlas for Government supports programmatic access using the following resources. However, AtlasGov is designed with additional security, compliance, and operational considerations to meet the needs of organizations that handle sensitive data. To learn more about how these considerations impact feature availability, see [Atlas for Government Considerations.](https://www.mongodb.com/docs/atlas/government/api.md#std-label-gov-considerations) ### DevOps Tools AtlasGov supports the following DevOps tools: | Product | Description | | --- | --- | | [Atlas Kubernetes Operator](https://www.mongodb.com/docs/atlas/operator/stable/ak8so-for-gov) | Manage Atlas resources alongside your Kubernetes-based applications, through your existing Kubernetes workflow. | | [HashiCorp Terraform MongoDB Atlas Provider](https://registry.terraform.io/providers/mongodb/mongodbatlas/latest/docs#configure-mongodb-atlas-for-government) | Integrate Atlas into your continuous delivery workflows with the HashiCorp Terraform MongoDB Atlas Provider. | ## Atlas for Government API The MongoDB Atlas for Government API (Application Programming Interface) functions in the same way as the Atlas API (Application Programming Interface), except that it uses the following base URL: ```shell https://cloud.mongodbgov.com/api/atlas/v2 ``` To use the MongoDB Atlas for Government API (Application Programming Interface) to manage your clusters, you must authenticate your API (Application Programming Interface) requests. The MongoDB Atlas for Government API (Application Programming Interface) accepts the following authentication methods: - Service account access tokens ([OAuth 2.0)](https://oauth.net/2/) - API keys ([HTTP Digest Authentication)](http://en.wikipedia.org/wiki/Digest_access_authentication) **Important:** We recommend you use service accounts instead of API (Application Programming Interface) keys to authenticate to the MongoDB Atlas for Government API (Application Programming Interface). API (Application Programming Interface) keys are a legacy authentication method. ### Example Usage This `curl` example retrieves database users for a project. Select the appropriate tab for your preferred method of authentication: ### Service Account To make an API (Application Programming Interface) request using a service account, use the service account to generate an access token, then use the access token in your request: 1. Retrieve the client secret for your service account. Locate the client secret beginning with `mdb_sa_sk_` that you saved immediately after [creating the service account](https://docs.atlas.mongodb.com/configure-api-access/#std-label-see-org-api-keys). If you didn't save the client secret, you must generate a new client secret. 2. Encode the client ID and secret in base64. For example, run: ```sh echo -n {clientId}:{clientSecret} | base64 ``` 3. Request an access token. **Important:** The access token is valid for 1 hour (3600 seconds). You can't refresh an access token. When this access token expires, repeat this step to generate a new one. Replace `{base64Auth}` in the following example with the output from the preceding step, then run: ```sh curl --request POST \ --url https://cloud.mongodbgov.com/api/oauth/token \ --header 'accept: application/json' \ --header 'cache-control: no-cache' \ --header 'authorization: Basic {base64Auth}' \ --header 'content-type: application/x-www-form-urlencoded' \ --data 'grant_type=client_credentials' ``` **Output:** ```sh {"access_token":"{accessToken}","expires_in":3600,"token_type":"Bearer"}% ``` 4. Make an API (Application Programming Interface) call. Replace `{accessToken}` in the following example with the output from the preceding step. The following sample `GET` request [returns all projects](https://www.mongodb.com/docs/api/doc/atlas-admin-api-v2/operation/operation-listgroups) in your organization: ```sh curl --request GET \ --url https://cloudgov.mongodb.com/api/atlas/v2/groups \ --header 'Authorization: Bearer {accessToken}' \ --header 'Accept: application/vnd.atlas.2023-02-01+json' \ --header 'Content-Type: application/json' ``` The following sample `POST` request takes a request body and [creates a project](https://www.mongodb.com/docs/api/doc/atlas-admin-api-v2/operation/operation-creategroup) named `MyProject` in your organization: ```sh curl --header 'Authorization: Bearer {accessToken}' \ --header "Content-Type: application/json" \ --header "Accept: application/vnd.atlas.2023-02-01+json" \ --include \ --request POST "https://cloudgov.mongodb.com/api/atlas/v2/groups" \ --data ' { "name": "MyProject", "orgId": "5a0a1e7e0f2912c554080adc" }' ``` ### See the Atlas Documentation - To learn more about using the API (Application Programming Interface), see the [Atlas API.](https://www.mongodb.com/docs/atlas/api/) - To learn more about authenticating to the API (Application Programming Interface) with service accounts or API (Application Programming Interface) keys, see [Atlas Administration API Authentication Methods.](https://docs.atlas.mongodb.com/api/api-authentication/#std-label-api-authentication) - To configure the API, see [Configure Atlas API Access.](https://www.mongodb.com/docs/atlas/configure-api-access/) - For a list of possible errors, see [Atlas API Error Codes.](https://www.mongodb.com/docs/atlas/reference/api/api-errors/) ### Creating a Project You must designate projects for either standard or government (`gov`) region usage upon creation. You cannot deploy clusters across government and standard regions in the same project. By default, the AtlasGov API designates new projects for standard region usage. To use the API to create a project for government regions, include the following in your `POST` request data: ```json "regionUsageRestrictions" : "GOV_REGIONS_ONLY" ``` **Tip: Atlas documentation** For detailed information on creating a project with the API, including an example request, see [Create One Project.](https://www.mongodb.com/docs/atlas/reference/api/project-create-one/) ## Atlas for Government Considerations The following cloud providers, MongoDB products, and features are unavailable for all API (Application Programming Interface) resources: - Azure (Microsoft Azure) - Atlas Online Archives - Atlas Triggers - MongoDB Charts - Atlas Device SDKs - Free, Flex, and `M10` clusters Many of the commercial Atlas API (Application Programming Interface) resources are limited or unavailable: ### Database Users Database users who authenticate with [SCRAM](https://www.mongodb.com/docs/manual/core/security-scram/) must use `SCRAM-SHA-256`. ### Clusters AtlasGov clusters must be tier `M20` or higher. Atlas doesn't support Free and Flex clusters. ### Alerts - Alerts related to payment methods are unavailable. - Alerts can come from several different email addresses. For more information, see [Alerts and Communications.](https://www.mongodb.com/docs/atlas/government/clusters/monitoring.md#std-label-alert-emails) ### Third-Party Integration Settings You must have the [`Project Owner`](https://docs.atlas.mongodb.com/reference/user-roles/#mongodb-authrole-Project-Owner) role to configure a third-party monitoring integration. #### Datadog When integrated with Datadog, AtlasGov uses the Datadog for Government site (US1-FED). To learn more about US1-FED, see the [Datadog documentation.](https://docs.datadoghq.com/getting_started/site/#the-datadog-for-government-site) ### Cloud Backups Restores between standard projects and Gov region-only projects aren't allowed. If you create a backup from a cluster in a Gov region-only (AWS GovCloud or GCP Assured Workloads) project, you can restore the data to a cluster only in a Gov region-only project. The same restriction applies to standard projects, where backups in standard regions can only be restored to clusters in standard projects. Cross-cloud restore is supported between AWS GovCloud and GCP Assured Workloads regions. ### Flex Cluster Snapshots and Restore Jobs Flex clusters are unavailable in AtlasGov. ### Online Archive Online Archives are unavailable in AtlasGov. ### Network Peering - You can peer AWS GovCloud regions with MongoDB clusters only in AWS GovCloud regions. You can peer AWS Commercial regions with MongoDB clusters only in AWS Commercial regions. - You can peer GCP Assured Workloads regions with MongoDB clusters only in GCP Assured Workloads regions. ### Private Endpoints - You can link AWS GovCloud regions with MongoDB clusters only in AWS GovCloud regions. You can link AWS Commercial regions with MongoDB clusters only in AWS Commercial regions. - You can link GCP Assured Workloads regions with MongoDB clusters only in GCP Assured Workloads regions. ### Monitoring and Logs In addition to the standard Atlas logging, AtlasGov logs the username and IP address associated with all failed login attempts, temporary lockouts and failed API (Application Programming Interface) digest authentications. ### Encryption at Rest using Customer Key Management - You must use KMS keys in AWS GovCloud and GCP Assured Workloads regions to encrypt data in AWS GovCloud and GCP Assured Workloads region-only projects. You must use KMS keys in AWS Commercial regions to encrypt data in AWS Commercial region-only projects. ### Atlas Users You cannot create MongoDB Atlas for Government users. MongoDB Atlas for Government is available by invitation only. ### Atlas Stream Processing Atlas Stream Processing is unavailable in AtlasGov. ### Triggers Triggers are unavailable in AtlasGov.