Skip to main content

​
URL structure

​
Supported methods and overview

​
Detailed description

This API endpoint initiates the process for obtaining an access token using either authorisation code or implicit OAuth 2.0 grant types. When using the implicit grant type, the access token itself is returned in the response to this API endpoint. (All other grant types return their access tokens in calls to the <access-service>/api/oauth/token endpoint.) If the client application has been configured on the Covata Platform to issue refresh tokens, then a refresh token will accompany the access token. However, regardless of this configuration, refresh tokens are never issued when using the implicit grant type.

​
Required parameters

The following required parameters must be sent in the URL of the request:
  • response_type - For the authorisation code grant type, specify the string value code or for the implicit grant type, specify token.
  • client_id - The client ID of your application’s client credentials, which would have been generated when your application was registered on the Covata Platform.
  • redirect_uri - Your application’s URL/URI, which for the:
    • authorisation code grant type, will handle the initial response from the Covata Platform that contains the actual authorisation code. This initial response is sent after the user has successfully authenticated.
    • implicit grant type, will handle the response from the Covata Platform that contains the access token itself. This response is sent after the user has successfully authenticated.
    Example (request - using the authorisation code grant type):
This request results in the Covata Platform presenting the user with the Covata Sign-in page. If the client application requesting this API endpoint was developed by a third party (i.e. a non-Covata client application), then an additional page is presented requesting the user to approve the client application access to the user’s resources on the Covata Platform. This step is known as the application approval step and only needs to be performed once (unless this approval is subsequently revoked by the user).

​
Returns

Once the Covata user has successfully authenticated (and if required, has accepted the application approval step), the Covata Platform responds by redirecting to your application’s URL/URI (i.e. the redirect_uri value above), whose following URL parameters depend on the grant type used:
  • code ( Authorisation code grant type only ) - The authorisation code value.
  • access_token ( Implicit grant type only ) - The access token itself, as a JSON Web Token (JWT) value. The resources (i.e. API endpoints) of the Covata Platform that this access token grants permission to are based on the Covata user whose credentials were used for authentication, this user’s roles (explained in more detail in the Organisation Administrator’s Guide) and if applicable to the API endpoint, the user’s:
    • membership of organisations and
    • ownership or collaborator status on files or folders.
  • token_type ( Implicit grant type only ) - The brief description for the type of token (above) - i.e. usually bearer.
  • scope ( Implicit grant type only ) - .
  • jti ( Implicit grant type only ) - The UUID value for the returned JWT access token. This value is a unique ID for the returned JWT, which is also known as a JWT ID.
    Example (response/redirect - using the authorisation code grant type):