Sign in

v1

latestOpenAPI 3.1.02026-07-136388308.2 KB
Authentication

Authenticate with the API.

This endpoint is needed to generate your access token. Access to the API is by Bearer Access Tokens. These are valid for 15 minutes. You can have multiple Access Tokens active at the same time if needed. See the Guide to Authentication for full details.

post/v1/apps/accesstokens

Request body

clientIdstring

The Client ID for this API Application

refreshTokenstring

The Refresh Token for this API Application

nonceinteger

A random non-repeating number used as a salt for the clientSecret below. The simplest nonce is a unix time.

grantType'AccessToken'

Always AccessToken. (This will change to refresh_token in a future release.)

clientSecretstring

The SHA256 hash of the nonce above and the app’s Client Key. The Client Key will only be shown to you when you create the app, so don’t forget to save it somewhere safe. SECRET=( /bin/echo -n $NONCE$CLIENT_KEY | sha256sum ).

Example request

{
  "clientId": "4ADFB67A-0F5B-4A9A-9D74-34437250045C",
  "refreshToken": "4ADFB67A-0F5B-4A9A-9D74-34437250045C",
  "nonce": 728345638475,
  "clientSecret": "4ADFB67A-0F5B-4A9A-9D74-34437250045C"
}

Response

Access token created

businessIdinteger

The business ID for the business.

apiApplicationIdinteger

The ID of the application you are using.

expirystring date-time

The expiry date and time for this token (ISO-8601).

permissionsstring[]

The permissions assigned to the Access Token as an array of strings. This provides information on what API access it is allowed. See the section on Scope below.

accessTokenstring

The App Bearer Access Token you can use in further API calls.

Example response

{
  "businessId": 248,
  "apiApplicationId": 433,
  "expiry": "2020-10-22T07:48:56.460Z",
  "permissions": [
    "PERM_BUSINESSES_GET_ACCOUNTS",
    "PERM_BUSINESSES_GET_ACCOUNT_TRANSACTIONS"
  ],
  "accessToken": "4ADFB67A-0F5B-4A9A-9D74-34437250045C"
}
All 64 operations