Individual

Issue individual token

POST/v4/service/platform/individual/token

Returns a short-lived access token for one individual of your organisation, for the privacy dashboard SDKs in your app or website. With the token, the individual reads and changes only its own consent records and its own individual record. Call this route from your backend when your user opens the consent screen, and give the token to the SDK.

Name the individual by its individualId or by its externalId (exactly one of them). The route never creates an individual: create it first with Create individual. The token expires after 600 seconds; get a new one when it expires.

This route is for servers only. It takes only an API key whose only scope is individual-tokens:issue (or the older individual-token:issue): an API key with another scope gets 403, and so does a request with an Origin header (a call from a browser). Each API key has a limit of requests per minute. A key of a sandbox organisation issues tokens for the sandbox organisation.

Issue individual token

Language of the request sample

curl -X POST 'https://demo-api.igrant.io/v4/service/platform/individual/token' \
  -H 'Authorization: ApiKey <your-api-key>' \
  -H 'Content-Type: application/json' \
  -d '{
  "externalId": "customer-1002"
}'

{
  "access_token": "<individual-token>",
  "token_type": "Bearer",
  "expires_in": 600,
  "individual_id": "6af0821c38e8f33dcf79962e"
}

Authorizations

Authorizationstringheaderrequired
Your API key with the prefix ApiKey: ApiKey <your-api-key>. Get an API key.
Scope:individual-tokens:issue

Body

application/json

individualIdstring
ID of the individual. Send this or externalId.
Example:"6af0821c38e8f33dcf79962e"
externalIdstring
Your own ID of the individual (its externalId). Send this or individualId.
Example:"customer-1002"
scopeenum<string>
Optional. The scope of the token. The only value is consent:self, which is also the default.
Available options:consent:self
Example:"consent:self"

Response

application/json

The individual token. The response has the headers Cache-Control: no-store and Pragma: no-cache.

access_tokenstring
The individual token. Send it as Authorization: Bearer <token> on the consent routes of the individual.
Example:"<individual-token>"
token_typeenum<string>
Available options:Bearer
Example:"Bearer"
expires_ininteger
Lifetime of the token in seconds.
Example:600
individual_idstring
ID of the individual of the token.
Example:"6af0821c38e8f33dcf79962e"