GetToken

Returns an access token that allows you to access the API's endpoints. The resources available via the API depend on the privileges your user account has in the system. If the user account is inactive, the request will not return an access token.

Each request generates a new token for the user account, but previous tokens are still functional until they expire. It is recommended to use an access token until it expires before generating a new one.

You can use the access token issued by a FintechOS server to run API requests on either the Studio or Portal web service.

Note: For OpenID Connect (OIDC) based authentication, such as Okta, Keycloak (only in releases prior to 21.1.9), Amazon Active Directory, etc., make sure that the following key is added to the web.config file, otherwise the access token will not be retrieved:

<add key="openid-login-is-external" value="1"/>

Syntax

The GetToken API endpoint supports two types of requests, using either the POST or the GET method. The GET method includes the authentication credentials as parameters which are visible in the request's URL. Therefore, it is less secure than the POST method which provides the credentials in the request's body. When possible, it is recommended to use the POST method to call the GetToken API endpoint. The GET method is available only for backward compatibility.

Copy 
POST <host_address>/api/Authorize/GetToken

Content-Type: application/json
            
{
    "username":<username>,
    "password":<password>,
    "client_id":<client_id>
}

or

Copy 
GET <host_address>/api/Authorize/GetToken?client_id=<client_id>&username=<username>&password=<password>&response_type=token
 
Parameter Description
host_address URL of the FintechOS platform server.
client_id Unique identifier of the FintechOS customer.
username Username of an existing user account on the FintechOS platform.
password Password of the above user account. If you forgot your password, see SendResetPassword and ChangePassword for details on how to change your user account password.
response_type Mandatory parameter set to "token" (for the GET variant only).

Response

Copy 
{
    "access_token": "5ec2d951-38d6-421d-ae51-8b749fd09082",
    "expires_in": 1200.0,
    "email": "jonathan.doe@abcd.com",
    "error": null
}
 
Key Description
access_token Access token required as a parameter when sending API requests.
expires_in Number of seconds the token is valid since it was generated. For instance, a value of 1200 indicates that the token is valid for 20 minutes.
You can change the token expiry time by changing the value of the token expiry parameter in the web.config file.
email Email address defined in the user account.
error Any error messages returned by the server. If the API request completes successfully, this value will be null.

Note: Alternatively, you can get an access token via the FintechOS Identity Provider, which you can then add to the AccessToken header and use it in your API requests. The request for the token is:

Copy 
POST dpakclogin.ondisplayftos.com/auth/realms/FintechOSRealm/protocol/openid-connect/token

Examples

Errors

Error 405 - Method Not Allowed