Trend Micro (TrendAI)

D TrendAI Vision One platform API and Cloud Accounts

Workloads call the Vision One API with a static bearer API key; there is no federation path. Keys get a custom role, can be created, listed and deleted by API and carry a last-used time, but the API accepts a 0-month expiry, Cloud Accounts keys can run 180 months, and Trend is not a GitHub secret-scanning partner. Into your cloud it is keyless on AWS, Azure, GCP and Alibaba (Trend is an OIDC issuer you trust), but OCI uses an API signing key and Okta wants a pasted admin API token.

Docs: docs.trendmicro.com · Checked 2026-10-22 · source YAML · dispute via PR

Inbound D

How a workload running anywhere authenticates to this product.

Static API key sent as "Authorization: Bearer", created under Administration → API Keys (or by the API) with a role, an expiry and an optional CIDR allowlist. Older user-account "authentication tokens" for APIs-only accounts are the same kind of static bearer token. No OIDC, workload identity or token-exchange path is documented.

automation.trendmicro.com checked 2026-10-22
“TrendAI Vision One™ uses token-based authentication to ensure that only legitimate accounts can use the APIs.”
automation.trendmicro.com checked 2026-10-22
“Authorization: Bearer <your authentication token>”
docs.trendmicro.com checked 2026-10-22
“From API Keys, you can create API keys, which enable third-party applications to connect with TrendAI Vision One™ APIs.”
docs.trendmicro.com checked 2026-10-22
“Click an API Key to modify details and restrict access to specified addresses or ranges in classless inter-domain routing (CIDR) notation.”
docs.trendmicro.com checked 2026-10-22
“Enter a name, role, expiration time, and description.”
docs.trendmicro.com checked 2026-10-22
“To ensure that only authorized applications can gain access to your TrendAI Vision One™ data, you must create a user account specifically configured to allow API usage.”
docs.trendmicro.com checked 2026-10-22
“In Automation Center to authenticate and make API requests for automation purposes”

Graded on the Vision One public API (/v3.0), which is how CI jobs, SOAR tools and SIEM connectors automate the platform. The Authentication guide and every key page describe a bearer API key and nothing else; no OIDC, GitHub Actions, cloud workload identity or token exchange is documented, and the Automation Center API reference itself is login-walled (automation.trendmicro.com/xdr/api-v3 redirects to the console), so anything only described there is not publicly verifiable. The Cloud Accounts onboarding key ("V1 CAM API Key") is the same kind of key: it is passed into your CloudFormation or Terraform deployment so the stack can call Vision One back, and it also works in Automation Center. Endpoint agents and Server & Workload Protection have their own keys, managed outside this API and not graded here. No tier gate is documented for API keys.

Outbound B

How this product reaches into your cloud, repos, or other SaaS.

Cloud Accounts deploys a stack that trusts Vision One as an identity provider: an IAM OIDC provider and roles in AWS, an app registration with a federated credential in Azure, a workload identity pool and provider in Google Cloud, and a RAM OIDC provider in Alibaba Cloud. Oracle Cloud gets a dedicated user with an identity-domains API key instead, and the Okta connector takes pasted Okta admin API tokens.

docs.trendmicro.com checked 2026-10-22
“IAM OIDC Provider (1)”
docs.trendmicro.com checked 2026-10-22
“iam:CreateOpenIDConnectProvider”
docs.trendmicro.com checked 2026-10-22
“Federated Credential (1)”
docs.trendmicro.com checked 2026-10-22
“These permissions include enabling the Cloud Accounts app and security services to obtain temporary credentials and complete tasks within your Azure cloud environment.”
docs.trendmicro.com checked 2026-10-22
“Workload Identity Pool Provider (1)”
docs.trendmicro.com checked 2026-10-22
“These permissions include enabling the Cloud Accounts app and security services to obtain temporary credentials and complete tasks within your Google Cloud environment.”
docs.trendmicro.com checked 2026-10-22
“Resource Access Management (RAM) OIDC (1)”
docs.trendmicro.com checked 2026-10-22
“The TrendAI Vision One™ API key is not used for maintaining the connection between TrendAI Vision One™ services and your cloud account.”
docs.trendmicro.com checked 2026-10-22
“The identity domains API key does not carry tags, because Oracle Cloud does not support tagging that resource type.”
docs.trendmicro.com checked 2026-10-22
“Data upload permission API token”
docs.trendmicro.com checked 2026-10-22
“API tokens have the same permissions as the user who creates them.”
docs.trendmicro.com checked 2026-10-22
“Connect TrendAI Vision One™ to your Microsoft Entra ID and grant permission to allow associated apps to access your Microsoft Entra ID data in one or multiple tenants.”

Checked: Cloud Accounts for AWS (CloudFormation, Terraform, Organizations, Control Tower), Azure (subscription, management group), Google Cloud (project, organization), Alibaba Cloud and OCI; the resource and permission pages for each; Microsoft Entra ID (admin consent to Trend's multi-tenant app, keyless); and Okta. AWS, Azure, Google Cloud and Alibaba are keyless: the deployed core stack registers Vision One as an OIDC issuer (IAM OIDC provider, Entra federated credential, GCP workload identity pool provider, RAM OIDC provider) and Trend gets temporary credentials from it, which makes Trend the OIDC issuer the rubric's A describes. The docs list these resources but do not print the trust conditions (audience, subject), so how tightly each trust is scoped was not verified. OCI is the exception: the core stack creates a dedicated identity-domains user with an API key (OCI API keys do not expire); the docs do not say where the private key is held, but no federation resource is created. Okta is the clearest static path: you paste one or two Okta API tokens that inherit the creating admin's permissions (Super admin or Org admin for user enforcement). Those static paths keep this at B; an Okta OAuth app and an OCI federation would make it A. The Cloud Accounts API key flows the other way (your stack calling Vision One) and is covered under inbound.

Hygiene for any static credential the product still issues

✗ Expiry enforceable	Fails. Every key has an expiration time, but Trend's own MCP server, generated from the Create API Keys schema, offers 1, 3, 6, 12 or 0 months, and Trend's published pytmv1 wheel (0.11.0) defaults months_to_expiration to 0. The public docs do not say what 0 means and the API reference is login-walled, so "0 = never expires" is a strong reading, not a quote. Separately, the Cloud Accounts onboarding key can be minted for 180 months (15 years), which is no practical limit. No organization policy to cap key lifetime is documented. A changeable default is not an enforced expiry (same call as elastic-cloud-api). Third-party connector tokens do expire after one year; a platform-wide cap like that for every key would flip this check. raw.githubusercontent.com checked 2026-10-22 “"monthsToExpiration": map[string]any{"description": "The duration of validity for the API key.", "enum": []any{1, 3, 6, 12, 0}, "type": "integer"}” docs.trendmicro.com checked 2026-10-22 “You can select from the following expiration periods when adding or updating a cloud account:” docs.trendmicro.com checked 2026-10-22 “180 months” docs.trendmicro.com checked 2026-10-22 “You cannot edit the expiration time of an API key after creation.” docs.trendmicro.com checked 2026-10-22 “Authentication tokens expire one year after generating.”
✓ Rotation via API	The v3.0 API has POST /iam/apiKeys (create), GET, PATCH (role, name, status) and POST /iam/apiKeys/delete, exposed in Trend's pytmv1 SDK and its Vision One MCP server, so a job can mint a replacement and delete the old key. The console docs also let you disable a key with a toggle. raw.githubusercontent.com checked 2026-10-22 “Create API Keys. Generates API keys that allow third-party applications to access the TrendAI Vision One™ APIs.” raw.githubusercontent.com checked 2026-10-22 “mcp.WithDescription("Delete Vision One API Keys")” pypi.org checked 2026-10-22 “[Delete API keys](https://automation.trendmicro.com/xdr/api-v3#tag/API-Keys/paths/~1v3.0~1iam~1apiKeys~1delete/post)”
✓ Scoped keys	Platform API keys are not tied to a human: each gets its own role, which can be a custom role flagged as assignable to API keys, built from the per-app permissions in the Authentication guide. New keys can no longer get Master Administrator. Keys can also be pinned to CIDR ranges. docs.trendmicro.com checked 2026-10-22 “The API keys are not attached to specific accounts, so you do not need to enter your user account email to create a new API key.” raw.githubusercontent.com checked 2026-10-22 “Whether the role can be assigned to an API key.” docs.trendmicro.com checked 2026-10-22 “As of October 27, 2025, you cannot assign the Master Administrator permissions to API keys.” docs.trendmicro.com checked 2026-10-22 “On the Permissions tab, under Dashboards & Reports → Reports, select the permission Third-party auditing (API only).”
✓ Last-used visible	The List API keys endpoint can sort by lastUsedDateTime, and the pytmv1 SDK's ApiKey model carries last_used_date_time, so dead keys can be found by API. The public console docs do not mention a last-used column, and the API reference that documents the field is login-walled; the receipts are Trend's own public code. raw.githubusercontent.com checked 2026-10-22 “mcp.WithDescription("List Vision One API Keys")” raw.githubusercontent.com checked 2026-10-22 “"lastUsedDateTime",”
✗ Leak revocation	Neither Trend Micro, TrendAI nor Vision One appears in GitHub's supported secret-scanning patterns table, so a leaked Vision One API key is not reported to Trend for revocation. docs.github.com checked 2026-10-22

Notes

One card for the Vision One platform: the public API (and the API keys it issues) and the Cloud Accounts app that connects AWS, Azure, Google Cloud, Alibaba Cloud and OCI. Trend Micro now brands the platform TrendAI Vision One. Three of five hygiene checks pass (rotation API, scoping, last used), which keeps inbound at D. Inbound moves to B or A only if the API accepts a federated token (GitHub Actions OIDC, cloud workload identity or a bring-your-own issuer). An enforced maximum key lifetime and GitHub secret-scanning partnership would add the missing checks. Several receipts come from Trend's public vision-one-mcp-server repo because the Automation Center API reference requires a console login; a reviewer with console access should confirm what monthsToExpiration 0 means.

Badge

[![wif.tax grade](https://wif.tax/badge/trendmicro-vision-one.svg)](https://wif.tax/p/trendmicro-vision-one/)