OAuth

Token Endpoint

Changed on

Exchange a refresh token, JWT assertion, or authorization code for tokens.

Error responses speak the RFC 6749 §5.2 dialect (top-level error + error_description), NOT platform Problem Details — reshaped by _TokenRoute. Malformed/missing parameters answer invalid_request; failed client authentication answers invalid_client (status 401 with a WWW-Authenticate: Basic challenge when the client attempted HTTP Basic, 400 otherwise). On the refresh arm, a revoked consent grant answers invalid_grant with error_description: "consent grant has been revoked" — terminal; restart the authorization flow.

post/oauth/token

Request

  • Base URL: / (relative, and the document was published on a file host, not at the API’s origin)
  • URL: /oauth/token
  • Auth: none required

Request body

assertionstring nullable
client_idstring nullable
client_secretstring nullable
codestring nullable
code_verifierstring nullable
grant_typestring required
redirect_uristring nullable
refresh_tokenstring nullable

Response

Successful Response

access_tokenstring required

The access token to send as a bearer token.

expires_ininteger required

Lifetime of the access token, in seconds.

id_tokenstring nullable

OpenID Connect ID token; omitted when none was issued.

refresh_tokenstring nullable

Refresh token for obtaining new tokens; omitted when none was issued.

scopestring nullable

Space-delimited effective scopes of the minted access token (RFC 6749 §3.3), computed the way the platform's resolvers enforce them (live scope grants ∩ client ceiling ∩ consent-grant scopes for agent tokens), so the granted set may be narrower than requested and clients must not assume they got what they asked for. Present on every response whose token carries at least one scope; OMITTED (never the ABNF-invalid empty string) only when the effective set is empty — reachable solely on legs where the client requested no scopes at the token endpoint (the token request carries no scope parameter, and consent fails closed on an empty intersection).

token_typestring

Token type; always bearer.

Example response

{
  "access_token": "at_example-access-token",
  "expires_in": 3600,
  "id_token": "example-id-token",
  "refresh_token": "rt_example-refresh-token",
  "scope": "apis:read capabilities:execute",
  "token_type": "bearer"
}

Changes

  • a60e7cd27ce9Revision changes
    • info

      added the media type application/json for the response with the status

    • info

      added the media type application/json for the response with the status

  • 5f971901d212Revision changes
    • breaking

      removed the media type application/problem+json for the response with the status

    • info

      added the non-success response with the status

    • info

      removed the non-success response with the status