The Net2 Local Web API is secured using JWT access tokens and refresh tokens following OAuth2 standards. Other than a very limited set of routes, you must first obtain an access token in order to make calls in the API.
Access tokens are valid for 30 minutes and refresh tokens are valid for 2 hours. This is to allow you to re-authenticate without having to provide user credentials every time but also to have to actively maintain authentication to allow for changes to be made to operator access with minimal delay.
Access Token Authentication
Access token authentication requires the following x-www-form-urlencoded parameters:
- username - Formatted [First Name] [Last Name].
- password - The operators password in plain text.
- grant_type - Set as "password".
- client_id - Taken from your licence file.
- scope - If you require a refresh token, set this to "offline_access", else omit this parameter.
These parameters are provided in the body a POST to the /api/v1/authorization/tokens route. This will return the following:
{ "access_token": "eyJhbGci...obLvVU8A", "token_type": "bearer", "expires_in": 1800, "refresh_token": "719560b5b5194eec819ae1e25f54ba41", "expiry_datetime": "2019-09-17T11:51:20.9832179Z" }
The access_token must then be provided in every API call.
This is included in the "Authorization" header in this format:
bearer [access_token]
Replace "[access_token]" with the value returned from the API e.g. eyJhbGci...obLvVU8A
If this token is not provided or the token has expired, then the call will result in a 401 error.
Refresh Token Authentication
Refresh tokens allow you to maintain authentication without having to provide the user credentials every time.
Refresh token authentication requires the following x-www.form-urlencoded parameters:
- refresh_token - The refresh token obtained when requesting an access token.
- grant_type - Set as "refresh_token".
- client_id - Taken from your licence file.
- scope - If you require a new refresh token, set this to "offline_access".
These parameters are provided in the body a POST to the /api/authorization/tokens route. This will return the same response as the access token request but with a new access token. This new access token will need to be provided in place of the old one.