Password grant

POST /oauth/token issues the token through OAuth 2.0 password grant in a single call. Use this route in technical integrations, with an operator dedicated to the integration.

Important

/oauth/token only accepts native authentication: it does not apply 2FA and does not accept LDAP. To reproduce the Riversoft Console Portal sign-in, with 2FA or LDAP, use Local sign-in and 2FA.

Obtain the token

Send the operator credentials in an application/x-www-form-urlencoded form:

read -r -p 'Operator: ' API_USER
read -r -s -p 'Password: ' API_PASSWORD; printf '\n'

curl -s \
  --data-urlencode 'grant_type=password' \
  --data-urlencode "username=$API_USER" \
  --data-urlencode "password=$API_PASSWORD" \
  "$API_BASE/oauth/token"

Response

{
  "access_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
  "scope": "{\"stcpcore\":{\"instance\":15,\"user\":15,\"service\":15,\"schedule\":15,...}}",
  "operator": "stcpadmin",
  "rest_name": "RestAPI",
  "token_type": "Bearer"
}

Field	Description
`access_token`	Token used in the following calls.
`scope`	Operator permissions on each resource group (JSON serialized as text).
`operator`	Authenticated operator.
`rest_name`	API registration name (`rest_name` in `config.json`).
`token_type`	Always `Bearer`.

The token is valid for 60 minutes by default. See how to use it in Session and logout.

Errors

HTTP	Situation
`400`	`grant_type` other than `password`, missing `username` or `password`, or empty body.
`401`	Credentials not accepted or operator locked (`Operator is locked, contact your system administrator`).
`415`	`Content-Type` other than `application/x-www-form-urlencoded`.
`500`	Internal error.

After the maximum number of failures set in the password policies, the operator is locked.

Full contract in Reference: Authentication.

Local sign-in and 2FA Single Sign-On