Dispatch Authentication API

openapi: 3.2.0
info:
  title: Dispatch REST API v3 Authentication API
  version: '3'
  summary: Field-service orchestration API for jobs, customers, organizations, appointments and work orders.
  description: The Dispatch REST API lets job sources (warranty companies, equipment manufacturers, lead-generation platforms) and service enterprises interact with Dispatch's core business objects to implement their service workflow on the Dispatch platform. Job sources authenticate with OAuth 2.0 client credentials; individual service providers authenticate with the resource-owner password grant.
  contact:
    name: Dispatch
    url: https://dispatch.me/contact
    email: sales@dispatch.me
  x-documentation: https://github.com/DispatchMe/v3-api-docs
servers:
- url: https://api.dispatch.me
  description: Production
- url: https://api-sandbox.dispatch.me
  description: Sandbox
security:
- bearerAuth: []
tags:
- name: Authentication
  description: OAuth 2.0 token issuance and refresh.
paths:
  /v3/oauth/token:
    post:
      operationId: createToken
      tags:
      - Authentication
      summary: Retrieve or refresh a bearer token
      description: Exchange credentials for an OAuth 2.0 bearer token. Job sources use the client_credentials grant; a single service provider uses the password grant. Tokens are temporary - handle 401 responses by retrieving a new token.
      security: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              oneOf:
              - $ref: '#/components/schemas/ClientCredentialsGrant'
              - $ref: '#/components/schemas/PasswordGrant'
              - $ref: '#/components/schemas/RefreshTokenGrant'
      responses:
        '200':
          description: Token issued
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/TokenResponse'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '500':
          $ref: '#/components/responses/InternalServerError'
        '503':
          $ref: '#/components/responses/ServiceUnavailable'
components:
  schemas:
    TokenResponse:
      type: object
      properties:
        access_token:
          type: string
        token_type:
          type: string
          examples:
          - bearer
        created_at:
          type: integer
          description: Unix timestamp
        expires_in:
          type: integer
          description: Lifetime in seconds
        refresh_token:
          type: string
    PasswordGrant:
      type: object
      description: Single service provider (user) authentication.
      required:
      - grant_type
      - username
      - password
      - client_id
      - client_secret
      properties:
        grant_type:
          type: string
          const: password
        username:
          type: string
          format: email
        password:
          type: string
        client_id:
          type: string
        client_secret:
          type: string
    RefreshTokenGrant:
      type: object
      required:
      - grant_type
      - refresh_token
      properties:
        grant_type:
          type: string
          const: refresh_token
        refresh_token:
          type: string
    ClientCredentialsGrant:
      type: object
      description: Job-source authentication.
      required:
      - grant_type
      - client_id
      - client_secret
      properties:
        grant_type:
          type: string
          const: client_credentials
        client_id:
          type: string
          description: Your public key
        client_secret:
          type: string
          description: Your secret key
  responses:
    ServiceUnavailable:
      description: Service Unavailable - temporarily offline for maintenance. Try again later.
    Unauthorized:
      description: Unauthorized - your OAuth2 bearer token is incorrect or expired.
    InternalServerError:
      description: Internal Server Error - Dispatch had a problem. Try again later.
    TooManyRequests:
      description: Too Many Requests - you have exceeded your rate limit.
    BadRequest:
      description: Bad Request - your request is malformed or otherwise invalid.
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      description: OAuth 2.0 bearer token obtained from POST /v3/oauth/token. Tokens are temporary (expires_in is returned with the token) and must be refreshed on 401.
    oauth2:
      type: oauth2
      description: OAuth 2.0. Job sources use client_credentials; individual service providers use the resource-owner password grant. Dispatch does not document a scope vocabulary - access is governed by an account-level ACL agreed with the account manager.
      flows:
        clientCredentials:
          tokenUrl: https://api.dispatch.me/v3/oauth/token
          refreshUrl: https://api.dispatch.me/v3/oauth/token
          scopes: {}
        password:
          tokenUrl: https://api.dispatch.me/v3/oauth/token
          refreshUrl: https://api.dispatch.me/v3/oauth/token
          scopes: {}
x-apievangelist:
  generated: '2026-07-20'
  method: generated
  source: https://github.com/DispatchMe/v3-api-docs/blob/master/source/index.html.md
  note: Dispatch publishes no machine-readable specification. This document was generated faithfully from the provider's own public REST API v3 documentation repository (DispatchMe/v3-api-docs, a public Slate docs site). Paths, methods, entity attributes, query parameters, statuses and error codes are transcribed from that source. Nothing was invented. Where the docs describe a list operation in prose without printing the endpoint line, the operation is flagged with x-path-inferred.