|
| 1 | +# Group Authorization with OAuth 2 |
| 2 | + |
| 3 | +Most API requests are authenticated with OAuth2. |
| 4 | + |
| 5 | +## OAuth 2 token exchange [/api/v3/oauth/token] |
| 6 | +The first step of OAuth is to exchange credentials for an `access_token`. This `access_token` is then used on subsequent resource requests. |
| 7 | + |
| 8 | +Supported grant types: |
| 9 | + |
| 10 | ++ `client_credentials` |
| 11 | ++ `password` |
| 12 | + |
| 13 | +### Exchange credentials for token [POST] |
| 14 | ++ Request Client Credentials grant |
| 15 | + + Attributes (OAuth grant request) |
| 16 | + + Headers |
| 17 | + |
| 18 | + Authorization: Basic ABCDEF |
| 19 | + |
| 20 | ++ Response 200 (application/json) |
| 21 | + + Attributes (OAuth valid response) |
| 22 | + |
| 23 | ++ Request Password grant |
| 24 | + + Attributes (OAuth password grant request) |
| 25 | + |
| 26 | ++ Response 200 (application/json) |
| 27 | + + Attributes (OAuth valid response) |
| 28 | + |
| 29 | +## Accessing a protected resource [/api/v3/protected] |
| 30 | + |
| 31 | +Now we have an `access_token` we add that to the `Authentication` header on all resource requests. |
| 32 | + |
| 33 | +### Accessing a protected resource [GET] |
| 34 | ++ Request With Valid token |
| 35 | + + Headers |
| 36 | + |
| 37 | + Authentication: Bearer accesstoken |
| 38 | + |
| 39 | ++ Response 200 (application/json) |
| 40 | + + Attributes (Server response) |
| 41 | + |
| 42 | + |
| 43 | ++ Request With Invalid or Expired token |
| 44 | + + Headers |
| 45 | + |
| 46 | + Authentication: Bearer invalidOrExpireToken |
| 47 | + |
| 48 | ++ Response 401 (application/json) |
| 49 | + + Attributes (Server error response) |
| 50 | + |
| 51 | ++ Request With insufficient permissions |
| 52 | + + Headers |
| 53 | + |
| 54 | + Authentication: Bearer accesstoken |
| 55 | + |
| 56 | ++ Response 403 (application/json) |
| 57 | + + Attributes (Server error response) |
| 58 | + |
| 59 | +# Data Structures |
| 60 | + |
| 61 | +## OAuth grant request (object) |
| 62 | ++ `grant_type`: `client_credentials` (string, required) |
| 63 | ++ `client_id` (string, required) |
| 64 | ++ `client_secret` (string, required) |
| 65 | ++ `scope`: post,user(string, optional) |
| 66 | + |
| 67 | +## OAuth password grant request (object) |
| 68 | ++ `grant_type`: `password` (string, required) |
| 69 | ++ `client_id` (string, required) |
| 70 | ++ `client_secret` (string, required) |
| 71 | ++ `username`: [email protected] ( string, required) |
| 72 | ++ `password`: somepassword (string, required) |
| 73 | ++ `scope`: post,user (string, optional) |
| 74 | + |
| 75 | +## OAuth valid response (object) |
| 76 | ++ `access_token`: `eyJhbGciOiJIUzI1NiJ9` (string, required) - valid access token |
| 77 | ++ scope: all (string, required) - scopes of current token |
| 78 | ++ `expires_in`: 300 (number, required) |
| 79 | ++ `token_type`: Bearer (string, required) |
| 80 | + |
| 81 | +## Server response (object) |
| 82 | ++ status: ok (string, required) |
0 commit comments