---
title: Manage ESVs using the API
description: You can find background information on ESVs in PingOne Advanced Identity Cloud in ESVs.
component: pingoneaic
page_id: pingoneaic:tenants:esvs-manage-api
canonical_url: https://docs.pingidentity.com/pingoneaic/tenants/esvs-manage-api.html
keywords: ["Environment secrets and variables (ESVs)", "REST API"]
page_aliases: ["tenants:esvs-manage.adoc"]
section_ids:
  esv_api_endpoints: ESV API endpoints
  authenticate_to_esv_api_endpoints: Authenticate to ESV API endpoints
---

# Manage ESVs using the API

You can find background information on ESVs in PingOne Advanced Identity Cloud in [ESVs](esvs.html).

## ESV API endpoints

Advanced Identity Cloud provides these API endpoints for ESVs:

* [Variables](https://docs.pingidentity.com/pingoneaic/_attachments/api/#tag/Variables) API endpoint

* [Secrets](https://docs.pingidentity.com/pingoneaic/_attachments/api/#tag/Secrets) API endpoint

* [Restart](https://docs.pingidentity.com/pingoneaic/_attachments/api/#tag/Restart) API endpoint

|   |                                                                                                                                                                                                                                           |
| - | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
|   | If you plan to delete an ESV using the variables or secrets API endpoints, you may first need to remove references to it from your environment. Learn more in [Preconditions to delete an ESV](esvs.html#preconditions-to-delete-an-esv). |

## Authenticate to ESV API endpoints

To authenticate to ESV API endpoints, use an [access token](../developer-docs/authenticate-to-rest-api-with-access-token.html) created with one of the following scopes:

| Scope                | Description                                                            |
| -------------------- | ---------------------------------------------------------------------- |
| `fr:idc:esv:*`       | Read, create, update, delete, and restart access to ESV API endpoints. |
| `fr:idc:esv:read`    | Read access to ESV API endpoints.                                      |
| `fr:idc:esv:update`  | Create, update, and delete access to ESV API endpoints.                |
| `fr:idc:esv:restart` | Restart access to ESV API endpoints.                                   |

|   |                                                                                                                                                                                                                                                    |
| - | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
|   | Service account access tokens granted the `fr:idm:*` scope also have access to API endpoints under the `fr:idc:esv:*` scope. However, this behavior is [deprecated](../product-information/deprecation-notices.html#esv-rest-api-using-idm-scope). |