The Token API from Autodesk Fusion — 7 operation(s) for token.
openapi: 3.0.0
info:
title: Construction.Account.Admin Account Management Token API
version: '1.0'
contact:
name: Autodesk Plaform Services
url: https://aps.autodesk.com/
email: aps.help@autodesk.com
termsOfService: https://www.autodesk.com/company/legal-notices-trademarks/terms-of-service-autodesk360-web-services/forge-platform-web-services-api-terms-of-service
x-support: https://stackoverflow.com/questions/tagged/autodesk-platform-services
description: 'The Account Admin API automates creating and managing projects, assigning and managing project users, and managing member and partner company directories. You can also synchronize data with external systems.
'
servers:
- url: https://developer.api.autodesk.com
security:
- 2-legged: []
- 3-legged: []
tags:
- name: Token
paths:
/authentication/v2/authorize:
parameters: []
get:
summary: Authorize User
description: 'Returns a browser URL to redirect an end user in order to acquire the user’s consent to authorize the application to access resources on their behalf.
Invoking this operation is the first step in authenticating users and retrieving an authorization code grant. The authorization code that is generated remains valid for 5 minutes, while the ID token stays valid for 60 minutes. Any access tokens you obtain are valid for 60 minutes, and refresh tokens remain valid for 15 days.
This operation has a rate limit of 500 calls per minute.
**Note:** This operation is intended for use with client-side applications only. It is not suitable for server-side applications.'
operationId: authorize
parameters:
- name: client_id
in: query
description: The Client ID of the calling application, as registered with APS.
required: true
schema:
type: string
- name: response_type
in: query
description: "The type of response you want to receive. Possible values are: \n\n- ``code`` - Authorization code grant.\n- ``id_token`` - OpenID Connect ID token.\n"
schema:
$ref: '#/components/schemas/responseType'
required: true
- name: redirect_uri
in: query
required: true
schema:
type: string
description: 'The URI that APS redirects users to after they grant or deny access permission to the application. Must match the Callback URL for the application as registered with APS.
Must be specified as a URL-safe string. It can include query parameters or any other valid URL construct.
'
- name: nonce
in: query
description: A random string that is sent with the request. APS passes back the same string to you so that you can verify whether you received the same string that you sent. This check mitigates token replay attacks
schema:
type: string
- name: state
in: query
description: "A URL-encoded random string. The authorization flow will pass the same string back to the Callback URL using the ``state`` query string parameter. This process helps ensure that the callback you receive is a response to what you originally requested. It prevents malicious actors from forging requests.\n\nThe string can only contain alphanumeric characters, commas, periods, underscores, and hyphens. \n"
schema:
type: string
- name: scope
in: query
description: 'A URL-encoded space-delimited list of requested scopes. See the `Developer''s Guide documentation on scopes </en/docs/oauth/v2/developers_guide/scopes/>`_ for a list of valid values you can provide.
The string you specify for this parameter must not exceed 2000 characters and it cannot contain more than 50 scopes. '
schema:
$ref: '#/components/schemas/Scopes'
type: string
required: true
- name: response_mode
in: query
description: "Specifies how the authorization response should be returned. Valid values are:\n\n- ``fragment`` - Encode the response parameters in the fragment of the redirect URI. A fragment in a URI is the optional part of the URI that appears after a ``#`` symbol, which refers to a specific section within a resource. For example, ``section`` in ``https://www.mysite.org/myresource#section``.\n- ``form_post`` - Embed the authorization response parameter in an HTML form.\n- ``query`` - Embed the authorization response as a query string parameter of the redirect URI. \n\nIf ``id_token`` is stated as ``response_type``, only ``form_post`` is allowed as ``response_mode``.'\n"
schema:
type: string
- name: prompt
in: query
description: "Specifies how to prompt users for authentication. Possible values are: \n\n- ``login`` : Always prompt the user for authentication, regardless of the state of the login session. \n\n**Note:** If you do not specify this parameter, the system will not prompt the user for authentication as long as a login session is active. If a login session is not active, the system will prompt the user for authentication.\n"
schema:
type: string
- name: authoptions
in: query
description: A JSON object containing options that specify how to display the sign-in page. Refer the `Developer's Guide documentation on AuthOptions </en/docs/oauth/v2/developers_guide/authoptions/>`_ for supported values.
schema:
type: string
- name: code_challenge
in: query
description: A URL-encoded string derived from the code verifier sent in the authorization request with the Proof Key for Code Exchange (PKCE) grant flow.
schema:
type: string
- name: code_challenge_method
in: query
description: 'The method used to derive the code challenge for the PKCE grant flow. Possible value is:
- ``S256``- Hashes the code verifier using the SHA-256 algorithm and then applies Base64 URL encoding.
'
schema:
type: string
responses:
'302':
description: Successfully redirected to the redirect URI.
content:
application/json:
schema:
type: object
tags:
- Token
/authentication/v2/revoke:
parameters:
- $ref: '#/components/parameters/Authorization'
post:
summary: Revoke Token
description: 'Revokes an active access token or refresh token.
An application can only revoke its own tokens.
This operation has a rate limit of 100 calls per minute.'
operationId: revoke
requestBody:
content:
application/x-www-form-urlencoded:
schema:
type: object
properties:
token:
type: string
description: "The token to be revoked. \n"
token_type_hint:
$ref: '#/components/schemas/tokenTypeHint'
client_id:
$ref: '#/components/schemas/clientId'
required:
- token
- token_type_hint
application/json:
schema:
type: object
properties: {}
required: true
responses:
'200':
description: The token was successfully revoked. This operation has no response body.
content:
application/json:
schema:
type: object
tags:
- Token
/authentication/v2/keys:
parameters: []
get:
summary: Get JWKS
description: "Returns a set of public keys in the JSON Web Key Set (JWKS) format.\n\nPublic keys returned by this operation can be used to validate the asymmetric JWT signature of an access token without making network calls. It can be used to validate both two-legged access tokens and three-legged access tokens. \n\nSee the Developer's Guide topic on `Asymmetric Signing </en/docs/oauth/v2/developers_guide/asymmetric-encryption/>`_ for more information. \n"
operationId: get-keys
responses:
'200':
description: ' A set of public keys in the JWKS format was returned successfully. '
headers: {}
content:
application/json:
schema:
$ref: '#/components/schemas/jwks'
example:
keys:
- kid: BMSYB0FZTBBA5EqqoF2g3CLYMuI5zEjl
kty: RSA
use: sig
n: hsCOmpYP17pNmRYgUjEPb3WzXNSvFQ0kmSWzbt2i5HYDkJmzKh7Vwgr5kQz5nQ6QVCFe2Ld30C0-a6Y9y2jolktskE6Chb8gG1bbvFdmH0TMsMLtOhzLOqSTfc8giwpYebJBmlW8BT_NWcdUH9Rk1ct4UPgu1OttzUHNulTG4t6d3X2I6oTndlGkonNPTjvEE9e5x4q38jC56RgWkS9pcdBSqa5vLeA-rGRcUyCDYVgLBaBJdnH-qxSNLbgftDmgDRdzj-sGUxUE85IY6wAadgdDMg0BWtLYwmFZwV38xPDyhSQ-AT3lvxDQMMco50Y7yOjoJf4qJ28XXZ-iNJXwUw
e: AQAB
tags:
- Token
/authentication/v2/token:
parameters: []
post:
summary: Acquire Token
description: "Returns an access token or refresh token.\n\n* If `grant_type` is `authorization_code`, returns a 3-legged access token for authorization code grant. \n* If `grant_type` is `client_credentials`, returns a 2-legged access token for client credentials grant.\n* If `grant_type` is `refresh_token`, returns new access token using the refresh token provided in the request.\n\nTraditional Web Apps and Server-to-Server Apps should use the ``Authorization`` header with Basic Authentication for this operation. Desktop, Mobile, and Single-Page Apps should use ``client_id`` in the form body instead.\n\nThis operation has a rate limit of 500 calls per minute.\n"
operationId: fetch-token
requestBody:
content:
application/x-www-form-urlencoded:
schema:
type: object
properties:
grant_type:
$ref: '#/components/schemas/GrantType'
code:
type: string
description: "The authorization code that was passed to your application when the user granted access permission to your application. It was passed as the ``code`` query parameter to the redirect URI when you called `Authorize User </en/docs/oauth/v2/reference/http/authorize-GET/>`_. \n\nRequired if `grant_type` is ``authorization_code``.\n"
redirect_uri:
type: string
description: "The URI that APS redirects users to after they grant or deny access permission to the application. Must match the Callback URL for the application registered with APS. \n\nRequired if `grant_type` is ``authorization_code``.\n"
code_verifier:
type: string
description: "A random URL-encoded string between 43 characters and 128 characters. In a PKCE grant flow, the authentication server uses this string to verify the code challenge that was passed when you called `Authorize User </en/docs/oauth/v2/reference/http/authorize-GET/>`_. \n\nRequired if ``grant_type`` is `authorization_code` and ``code_challenge`` was specified when you called `Authorize User </en/docs/oauth/v2/reference/http/authorize-GET/>`_.\n"
refresh_token:
type: string
description: 'The refresh token used to acquire a new access token and a refresh token.
Required if ``grant_type`` is ``refresh_token``.
'
scope:
$ref: '#/components/schemas/Scopes'
client_id:
$ref: '#/components/schemas/clientId'
application/json:
schema:
type: object
properties: {}
responses:
'200':
description: An access token was successfully returned.
content:
application/json:
schema:
type: object
properties: {}
parameters:
- $ref: '#/components/parameters/Authorization'
tags:
- Token
/authentication/v2/introspect:
parameters: []
post:
summary: Introspect Token
description: 'Returns metadata about the specified access token or reference token.
An application can only introspect its own tokens.
This operation has a rate limit of 500 calls per minute.'
operationId: introspect_token
requestBody:
content:
application/x-www-form-urlencoded:
schema:
type: object
properties:
token:
type: string
description: The token to be introspected.
client_id:
$ref: '#/components/schemas/clientId'
responses:
'200':
description: Metadata was successfully returned.
content:
application/json:
schema:
$ref: '#/components/schemas/introspectToken'
tags:
- Token
parameters:
- $ref: '#/components/parameters/Authorization'
/.well-known/openid-configuration:
get:
summary: Get OIDC Specification
tags:
- Token
responses:
'200':
description: The OIDC specification was successfully returned.
content:
application/json:
schema:
$ref: '#/components/schemas/OidcSpec'
operationId: get-oidc-spec
description: Returns an OpenID Connect Discovery Specification compliant JSON document. It contains a list of the OpenID/OAuth endpoints, supported scopes, claims, public keys used to sign the tokens, and other details.
/authentication/v2/logout:
get:
summary: Logout
tags:
- Token
responses:
'302':
description: The user was successfully logged out.
operationId: logout
description: 'Signs out the currently authenticated user from the APS authorization server. Thereafter, this operation redirects the user to the ``post_logout_redirect_uri``, or to the Autodesk Sign-in page when no ``post_logout_redirect_uri`` is provided.
This operation has a rate limit of 500 calls per minute.
'
parameters:
- schema:
type: string
in: query
name: post_logout_redirect_uri
description: "The URI to redirect your users to once logout is performed. If you do not specify this parameter your users are redirected to the Autodesk Sign-in page. \n\n**Note:** You must provide a redirect URI that is pre-registered with APS. This precaution is taken to prevent unauthorized applications from hijacking the logout process.\n"
components:
schemas:
OidcSpec:
title: OIDC Specification Response
type: object
properties:
issuer:
type: string
description: The base URL of the openID Provider. Always ``https://developer.api.autodesk.com`` for APS.
authorization_endpoint:
type: string
description: The endpoint for authorizing users. It initiates the user authentication process in obtaining an authorization code grant.
token_endpoint:
type: string
description: The endpoint for acquiring access tokens and refresh tokens.
userinfo_endpoint:
type: string
description: The endpoint for querying information about the authenticated user.
jwks_uri:
type: string
description: The endpoint for retrieving public keys used by APS, in the JWKS format.
revoke_endpoint:
type: string
description: The endpoint for revoking an access token or refresh token.
introspection_endpoint:
type: string
description: The endpoint for obtaining metadata about an access token or refresh token.
scopes_supported:
type: array
items:
type: string
description: A list of supported scopes.
response_types_supported:
type: array
items:
type: string
description: A list of the response types supported by APS. Each response type represent a different flow.
response_modes_supported:
type: array
items:
type: string
description: A list of response modes supported by APS. Each response mode defines a different way of delivering an authorization response.
grant_types_supported:
type: array
items:
type: string
description: A list of grant types supported by APS. Each grant type represents a different way an application can obtain an access token.
subject_types_supported:
type: array
items:
type: string
description: A list of subject identifier types supported by APS.
id_token_signing_alg_values_supported:
type: array
items:
type: string
description: A list of all the token signing algorithms supported by APS.
x-examples:
Example 1:
issuer: https://developer.api.autodesk.com
authorization_endpoint: https://developer.api.autodesk.com/authentication/v2/authorize
token_endpoint: https://developer.api.autodesk.com/authentication/v2/token
userinfo_endpoint: https://api.userprofile.autodesk.com/userinfo
jwks_uri: https://developer.api.autodesk.com/authentication/v2/keys
revocation_endpoint: https://developer.api.autodesk.com/authentication/v2/revoke
introspection_endpoint: https://developer.api.autodesk.com/authentication/v2/introspect
scopes_supported:
- user-profile:read
- user:read
- user:write
- viewables:read
- data:read
- data:write
- data:create
- data:search
- bucket:create
- bucket:read
- bucket:update
- bucket:delete
- code:all
- account:read
- account:write
- openid
response_types_supported:
- code
- code id_token
- id_token
response_modes_supported:
- fragment
- form_post
- query
grant_types_supported:
- authorization_code
- client_credentials
- refresh_token
subject_types_supported:
- public
id_token_signing_alg_values_supported:
- RS256
description: Represents a successful response to a Get OIDC Specification operation.
responseType:
title: responseType
x-stoplight:
id: pzowclrc6omzd
type: string
enum:
- code
- id_token
description: "The type of response you want to receive. Possible values are: \n\n - ``code`` - Authorization code grant.\n - ``id_token`` - OpenID Connect ID token.\n"
Scopes:
title: Scopes
x-stoplight:
id: l6ukt54b1u998
type: string
description: 'Specifies the scope for the token you are requesting. See the `Developer''s Guide documentation on scopes </en/docs/oauth/v2/developers_guide/scopes/>`_ for a complete list of possible values.
'
enum:
- user:read
- user:write
- user-profile:read
- viewables:read
- data:read
- data:read:<URN_OF_RESOURCE>
- data:write
- data:create
- data:search
- bucket:create
- bucket:read
- bucket:update
- bucket:delete
- code:all
- account:read
- account:write
- openid
jwksKey:
title: jwkskey
type: object
properties:
kid:
type: string
description: The ID of the key. Acts as a unique identifier for a specific key within the JWKS.
kty:
type: string
description: The cryptographic algorithm family used with the key. Currently, always ``RSA``.
use:
type: string
description: 'The intended use of the public key. Possible values:
- ``sig`` - Verify the signature on data.
'
n:
type: string
description: The RSA modulus value.
e:
type: string
description: The RSA exponent value.
x-stoplight:
id: wp3vjpqnp0rt9
description: Represents a JSON Web Key Set (JWKS).
GrantType:
title: grantType
x-stoplight:
id: qabq62fprc7su
type: string
enum:
- client_credentials
- authorization_code
- refresh_token
description: "Specifies the grant type you are requesting the code for. Possible values are: \n\n- ``client_credentials`` - For a 2-legged access token.\n- ``authorization_code`` - For a 3-legged access token.\n- ``refresh_token`` - For a refresh token.\n"
clientId:
title: clientId
x-stoplight:
id: j0qsjvxe873qp
type: string
description: 'The Client ID of the application making the request.
**Note** This is required only for Traditional Web Apps and Server-to-Server Apps. It is not required for Desktop, Mobile, and Single-Page Apps.'
tokenTypeHint:
title: tokenTypeHint
x-stoplight:
id: ygxy8lpuc8nuh
type: string
enum:
- access_token
- refresh_token
description: 'The type of token to revoke. Possible values are: ``access_token`` and ``refresh_token``.
'
introspectToken:
title: Introspect Token Response
description: Represents the payload returned for an introspect token request.
required:
- active
- client_id
- exp
- scope
type: object
properties:
active:
type: boolean
description: '``true``: The token is active.
``false``: The token is expired, invalid, or revoked.
'
scope:
type: string
description: A URL-encoded, space separated list of scopes associated with the token.
client_id:
type: string
description: The Client ID of the application associated with the token.
exp:
type: integer
description: The expiration time of the token, represented as a Unix timestamp.
userid:
type: string
description: The ID of the user who authorized the token.
x-stoplight:
id: ovhi8qyq55tzp
jwks:
title: JWKS Payload
x-stoplight:
id: 54hqs1b4gv5fy
type: object
description: Represents a successful response to a Get JWKS operation.
properties:
keys:
type: array
x-stoplight:
id: mrc2tc7y5gded
description: An array of objects where each object represents a JSON Web Key Set (JWKS).
items:
$ref: '#/components/schemas/jwksKey'
parameters:
Authorization:
name: Authorization
in: header
required: false
schema:
type: string
description: 'Must be ``Bearer <BASE64_ENCODED_STRING>`` where ``<BASE64_ENCODED_STRING>`` is the Base64 encoding of the concatenated string ``<CLIENT_ID>:<CLIENT_SECRET>``.''
**Note** This header is required only for Traditional Web Apps and Server-to-Server Apps. It is not required for Desktop, Mobile, and Single-Page Apps.
'
securitySchemes:
2-legged:
type: oauth2
flows:
clientCredentials:
tokenUrl: ''
refreshUrl: ''
scopes: {}
3-legged-implicit:
type: oauth2
flows:
implicit:
authorizationUrl: ''
refreshUrl: ''
scopes: {}
3-legged:
type: oauth2
flows:
authorizationCode:
authorizationUrl: ''
tokenUrl: ''
refreshUrl: ''
scopes: {}
x-stoplight:
id: zm6m3b30rcbon