API / Venafi Interview questions
What is the difference between the VEDAuth and VEDSDK endpoints in TPP?
Both are REST API paths exposed by TPP, but they handle two different jobs in the same authenticated session.
| /vedauth | /vedsdk |
| Issues OAuth access and refresh tokens | Performs the actual certificate operations |
| Called once per session (or on refresh) | Called repeatedly during the session |
| Takes a client ID and user credentials or an API key | Takes the bearer token from /vedauth in its headers |
In practice, a client like VCert first calls /vedauth to get a short-lived token, then attaches that token to subsequent calls against /vedsdk — requesting a certificate, checking its status, or downloading it once issued. Separating authentication from operations means tokens can be scoped and expired independently of the underlying certificate workflow.
What does the /vedauth endpoint in TPP handle?
Once a client has a token from /vedauth, where does it use that token?
More Related questions...
