After the e-form is submitted and the API contract is created, the corresponding entitlement is granted at the institution level. At the application level, APIs that use JWT Bearer grant type should be assigned RBAC roles to the certificate created by the security officer from the Online Operations Management (O2M) application. APIs that use Password grant type should be assigned API service contract to the License ID & Secret created on Swift.com.