---
title: "OAuth2 Access Token"
method: POST
path: "/oauth/access_token"
tags: ["OAuth2"]
---

# OAuth2 Access Token

`POST /oauth/access_token`

## Request body

- union
  - AuthorizationCodeGrant — OAuth2 Authorization Code grant type request.
    - `grant_type` 'authorization_code', required — The type of grant being requested.
    - `client_id` string, required — The client id provided when you requested access to the API.
    - `client_secret` string, required — The client secret provided when you requested access to the API.
    - `scope` 'admin', required — Requested OAuth2 scopes. Currently only `admin` is supported.
    - `redirect_uri` string, uri, required — Where to send the code; the same URI you provided when you requested access to the API. Required for authorization_code grant type.
    - `code` string, required — The authorization code received from the /oauth/authorize endpoint.
  - RefreshTokenGrant — OAuth2 Refresh Token grant type request.
    - `grant_type` 'refresh_token', required — The type of grant being requested.
    - `client_id` string, required — The client id provided when you requested access to the API.
    - `client_secret` string, required — The client secret provided when you requested access to the API.
    - `scope` 'admin', required — Requested OAuth2 scopes. Currently only `admin` is supported.
    - `refresh_token` string, required — The refresh token received from a previous /oauth/access_token request.
  - PasswordGrant — OAuth2 Password (Resource Owner Password Credentials) grant type request.
    - `grant_type` 'password', required — The type of grant being requested.
    - `client_id` string, required — The client id provided when you requested access to the API.
    - `client_secret` string, required — The client secret provided when you requested access to the API.
    - `scope` 'admin', required — Requested OAuth2 scopes. Currently only `admin` is supported.
    - `username` string, required — The user's username.
    - `password` string, password, required — The user's password.

## Response `200`

Token Granted

- object
  - `token_type` string, required — The type of token issued.
  - `expires_in` integer, required — Lifetime in seconds of the access token.
  - `access_token` string, required — The access token issued by the authorization server.
  - `refresh_token` string, required — The refresh token, which can be used to obtain new access tokens.

## Other responses

- `400` — Invalid parameter format

---

[API](https://skmtc.net/harborcompliance/apis/harbor-compliance-api.md) · [All operations](https://skmtc.net/harborcompliance/apis/harbor-compliance-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/harborcompliance/harbor-compliance-api/revisions/f9302ec2ef8a/schema)