Authorisation Server

Get access token

POST/v4/service/consent/data-space/{organisationId}/token

The OAuth 2.0 token endpoint of the data space endpoints of an organisation (the token_endpoint of its authorisation server metadata). A party that has an OAuth 2.0 client of the organisation, for example your data marketplace, gets an access token here with the client_credentials grant. The token works for 1 hour at POST .../get-verification-request and POST .../post-verification-request of the same organisation. No API key: the client credentials authenticate the call.

Send the client credentials as HTTP Basic authentication (Authorization: Basic <base64 of client_id:client_secret>) or as the form fields client_id and client_secret, not both. The credentials of an OAuth 2.0 client of the organisation (POST /v4/config/consent/data-space/oauth2-client) and the client credentials of a connected organisation work. A new token for a client replaces the token that the client got before: the earlier token stops working.

The service of a data using service uses the grant urn:ietf:params:oauth:grant-type:jwt-bearer with an assertion when it pulls data (POST /v4/service/consent/data-space/pull-data). That access token is a JWT for the API of the data source; the data source checks it with POST /v4/service/consent/data-space/validate-access.

Send the body as application/x-www-form-urlencoded, with no other value in the Content-Type header (no charset).

Errors have the OAuth 2.0 form (error, error_description), except 403:

400 invalid_request: the organisation does not exist, the form is not valid, both authentication methods are there, or the assertion is missing or not valid. 400 unsupported_grant_type: another grant type.
401 invalid_client: no or unknown client credentials (with a WWW-Authenticate header). 401 unauthorized_client or invalid_token: the service refused the assertion (signature, expiry, a jti that was used before, a record that is not opted in).
403: the organisation is suspended. The body is {"errorCode": 403, "errorDescription": "organisation_suspended"}.
415 invalid_request: the Content-Type is not application/x-www-form-urlencoded.

Get access token

Language of the request sample

curl -X POST 'https://demo-api.igrant.io/v4/service/consent/data-space/{organisationId}/token' \
  -H 'Content-Type: application/x-www-form-urlencoded' \
  --data-urlencode 'grant_type=client_credentials' \
  --data-urlencode 'client_id=6af1b8e02d6fb7b6ac6efd10' \
  --data-urlencode 'client_secret=<client-secret>' \
  --data-urlencode 'assertion=string'

{
  "access_token": "<access-token>",
  "token_type": "Bearer",
  "expires_in": 3600,
  "scope": "verify"
}

Authorizations

Public. The operation takes no credentials.

Path parameters

organisationIdstringrequired
The ID of the organisation

Body

application/x-www-form-urlencoded

grant_typeenum<string>required
client_credentials for a client of the organisation. urn:ietf:params:oauth:grant-type:jwt-bearer is for the pull data call of a data using service.
Available options:client_credentials,urn:ietf:params:oauth:grant-type:jwt-bearer
client_idstring
Client ID, when you do not use HTTP Basic authentication. Only for client_credentials.
client_secretstring
Client secret, with client_id. Only for client_credentials.
assertionstring
The signed JWT about the data disclosure agreement record. Mandatory for urn:ietf:params:oauth:grant-type:jwt-bearer.

Response

application/json

The access token. The answer has the headers Cache-Control: no-store and Pragma: no-cache.

access_tokenstring
The access token. Send it as Authorization: Bearer <token>.
token_typeenum<string>
Always Bearer.
Available options:Bearer
expires_ininteger
Lifetime of the token in seconds. Always 3600.
scopeenum<string>
Always verify, for both grant types.
Available options:verify