Connect Qevlar to Mimecast to resolve Mimecast-rewritten URLs from protected emails during investigations. This page lists the API permissions Qevlar requires and how to grant them.
Overview
Qevlar authenticates to Mimecast with an API 2.0 application (OAuth 2.0 client credentials). The Client ID and Client Secret are exchanged for a bearer token — no user account or interactive sign-in. The connector is read-only.
| API | Purpose | Auth |
|---|---|---|
| Mimecast API 2.0 | Decode Mimecast-rewritten (URL Protection) links | OAuth 2.0 bearer token |
The API base is https://api.services.mimecast.com.
Connection details
Enter these values when configuring the connector in Qevlar:
| Field | Where to find it | Required |
|---|---|---|
| Client ID | Mimecast Administration → API and Platform Integrations → your API 2.0 integration | Yes |
| Client Secret | Shown once when the integration is created | Yes |
Required permissions
Create a Mimecast API 2.0 application, scope it to the Targeted Threat Protection — URL Protect product, and give it an application role with the Account | Dashboard | Read permission. Both the URL Protect product scope and the Account | Dashboard | Read permission are required to call the URL decode endpoint. No other permissions are needed, and no write access is required.
Before you start: the administrator creating this integration needs a Mimecast role with Read and Edit on API Application Permissions (under the Service menu) and permission to manage Application Roles.
Setup
- Create an API 2.0 integration. In the Mimecast Administration console, go to Services → API and Platform Integrations → Mimecast API 2.0 and create your own integration.
- Grant URL Protection access and the Account | Dashboard | Read permission. Ensure the integration is scoped to the Targeted Threat Protection — URL Protect product and its application role includes Account | Dashboard | Read.
- Record the credentials. Copy the Client ID and Client Secret — the secret is shown only once.
- Configure the connector. In Qevlar, add the Mimecast connector and enter the connection details above.
Verify the connection
After saving, Qevlar runs a health check that acquires a bearer token. If it fails, check, in order:
- The Client ID and Client Secret are correct and the secret has not been regenerated.
- The API 2.0 integration is enabled, scoped to URL Protect, and its role includes Account | Dashboard | Read.
API reference
| Operation | HTTP | Endpoint |
|---|---|---|
| Token request | POST | https://api.services.mimecast.com/oauth/token |
| Decode URL | POST | https://api.services.mimecast.com/api/ttp/url/decode-url |
Auth header: Authorization: Bearer <token>.