Ok, so safe to conclude it needs to be an access token from within the CM module, and not a registered application with client/secret, making it impossible to create system access.
If I were to use this API token to integrate CM with an external app, it is completely dependent on my existence or whichever user account is used) for the integration. Offboarding a user kills the integration then.
Nonetheless, thanks for this input. I can at least proceed.
But @UiPath: this is hardly a sustainable setup. Please combine the API sets with the regular access ones for all other service. Something to do with consistency. I’m aware CM was ‘aquired’ and still leans on non-UiPath interfaces but put it on a backlog somwhere please.
@Anil_G I’ll mark you as solution as soon as I’ve been able to test it (after Easter).