With API 6.0 authentication and authorization is done through OAuth 2.

To get access to the protected resources OAuth 2.0 uses Access Tokens. An Access Token is a string representing the granted permissions.

To access to Dataloy API, you must request an Access Token for it. To do so, you will need to POST to the token URL.

Example POST to token URL

{
"client_id":"G99j845dM4MtckQlKt8E6o......",
"client_secret":"-mMElVOMzvht2SyQPfVh-WIaPCbOxRdWN5YngBxtBKybQmli-....",
"audience":"https://dataloy.internal",
"grant_type":"client_credentials"
}

Parameter Name	Description
`grant_type`	Set this to "client_credentials".
`client_id`	Your M2M Client ID.
`client_secret`	Your M2M Client Secret.
`audience`	The audience for the token, which is your API

If all goes well, you'll receive an HTTP 200 response with a payload containing access_token, token_type, and expires_in values:

To call an API endpoint you must pass the retrieved Access Token as a Bearer token in the Authorization header of your HTTP request.

curl --request GET \ --url https://myapi.com/api \ --header 'authorization: Bearer ACCESS_TOKEN' \ --header 'content-type: application/json'

When an endpoint is invoked with an expired token the server sends a HTTP 401 response with the following payload:

{
    "statusCode": 401,
    "statusText": "Unauthorized",
    "message": "Token expired.",
    "date": "2019-11-13T06:26:01",
    "statusFamily": "CLIENT_ERROR",
    "method": "GET",
    "uri": "http://platform-dev.dataloy.com/ws/rest/Cargo?filter=subCargos.freight%28GTE%292500000"

The client should not ask for a new token for each call but use the same token as long as it is valid.

Browser not supported