HERE OAuth 2.0 Access Token

{"openapi":"3.0.2","info":{"title":"OAuth 2.0 Access Token","version":"1.2.0","description":"Request an OAuth 2.0 access token that identifies your identity\nThe term \"realm\" is now known as \"organization\" or \"org\".\n"},"externalDocs":{"description":"The developer guide and related API references are available here.","url":"https://www.here.com/docs/category/identity-and-access-management"},"servers":[{"url":"https://account.api.here.com"}],"tags":[{"name":"Authorization Server Metadata"},{"name":"Client Registration","description":"OAuth Relying Party - Client Registration"},{"name":"OAuth 2.0 Access Token Endpoint"},{"name":"Device Token Management"}],"paths":{"/.well-known/oauth-authorization-server":{"get":{"tags":["Authorization Server Metadata"],"summary":"Get OAuth Authorization Server Metadata","operationId":"OAuth 2.0 Access Token getAuthServerMetadata","description":"Returns OAuth 2.0 Authorization Server Metadata according to https://datatracker.ietf.org/doc/html/rfc8414#section-3.1\n","responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AuthServerMetadata"}}}}}}},"/.well-known/oauth-authorization-server/mcp":{"get":{"tags":["Authorization Server Metadata"],"summary":"Get MCP OAuth Authorization Server Metadata","operationId":"OAuth 2.0 Access Token getMcpAuthServerMetadata","security":[],"description":"Returns OAuth 2.0 Authorization Server Metadata according to https://datatracker.ietf.org/doc/html/rfc8414#section-3.1\n","responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MCPAuthServerMetadata"}}}}}}},"/mcp/register":{"post":{"tags":["Client Registration"],"summary":"Dynamically register a MCP client.","operationId":"OAuth 2.0 Access Token RegisterMcpClient","description":"Registers a new public OAuth client for use with the MCP Authorization Code\n+ PKCE flow, per <a href=https://datatracker.ietf.org/doc/html/rfc7591>RFC 7591</a>.\nNo authentication is required.\n\nNote - Fields like client_uri, logo_uri, contacts etc. are not supported yet.\n","security":[],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/McpClientRegistrationRequest"}}}},"responses":{"201":{"description":"Client registered.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/McpClientRegistrationResponse"}}}},"400":{"description":"Registration failed. OAuth error codes per <a href=https://datatracker.ietf.org/doc/html/rfc7591#section-3.2.2>RFC 7591 Section 3.2.2</a>.\n* invalid_redirect_uri  - A redirect URI is missing or fails validation.\n* invalid_client_metadata - Disallowed grant_types/response_types/token_endpoint_auth_method,\n  or application_type conflicts with the supplied redirect URIs.\n\n* invalid_request - Malformed JSON or missing body.\n"},"413":{"description":"Request body exceeds the maximum allowed size."},"429":{"description":"Registration rate limit exceeded (per-IP or global DCR cap). A Retry-After header SHOULD be present.\n"},"default":{"$ref":"#/components/responses/CommonError"}}}},"/oauth2/token":{"post":{"tags":["OAuth 2.0 Access Token Endpoint"],"summary":"Request an OAuth 2.0 access token that identifies your identity","operationId":"OAuth 2.0 Access Token getOAuth2AccessToken","description":"Request an OAuth 2.0 access token that identifies your identity\n## **Grant Types:**\n\n### **Client Credentials Grant Type [client_credentials]**\n* **Request a client token that identifies your application by providing your client credentials.**\n  - Use grant type - client_credentials\n  - An optional scope can be added to the request body to request a project scoped access token\n  - **Client Authentication Methods (one of the following):**\n    1. **OAuth 1.0 Signed Request :** The request must be signed with the provisioned client\n       access key secret (here.access.key.secret) as documented in [Signing Requests](http://oauth.net/core/1.0/#signing_process)\n    2. **JWT Assertion (private_key_jwt, recommended):** Provide `client_assertion_type` and `client_assertion`\n       parameters in the request body. When using JWT assertion authentication, OAuth 1.0 signature headers\n       are NOT required. The client authenticates by presenting a signed JWT containing:\n       - `iss`: client_id of the application\n       - `sub`: client_id of the application\n       - `aud`: token endpoint URL\n       - `exp`: expiration time\n       - `iat`: issued at time\n       - `jti`: unique assertion id (for replay protection)\n\n       The JWT must be signed with a private key whose corresponding public key has been registered\n       via the JWKs management API (`POST /apps/{app}/jwks`).\n  - Developers may wish to try out the sample Java code in\n[documentation](https://developer.here.com/documentation/identity-access-management/dev_guide/topics/sdk.html) demonstrating this API\n\n### **Token Exchange Grant Type [urn:ietf:params:oauth:grant-type:token-exchange]**\n* **Create a new HERE access token via exchange of an existing trusted OpenID Connect Identity Provider \naccess token.**\n  - Use grant type - urn:ietf:params:oauth:grant-type:token-exchange\n  - Client authentication via the Authorization header is not required\n  - The subject_token identifies the access context in the third-party issuer's identity namespace, \n    and the \"sub\" claim within that token uniquely identifies the security principal within that \n    identity provider's namespace\n  - If used with a IdentityProvider that is configured for accountType=device, and a \"sub\" claim is present, \n    a DeviceAccount is created upon first token exchange and re-used for subsequent tokens with the same \"sub\" \n    claim value\n  - See also [OAuth 2.0 Token Exchange](https://www.rfc-editor.org/rfc/rfc8693)\n\n### **External Issuer Grant Type [jwtIssNotHERE]**\n* **Sign In with OpenID Connect compliant OEM token**\n  - Use grant type - jwtIssNotHERE\n  - The OEM access token is used in the authorization header\n","requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SignInRequestJson"}},"application/x-www-form-urlencoded":{"schema":{"$ref":"#/components/schemas/SignInRequestForm"}}}},"responses":{"200":{"description":"OK","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SignInResponse"},"example":{"accessToken":"eyJhbGciOiJSUzUxMiIsImN0e...x1dEEtSlJ4eFBvOEREZzJyeVFHOU9pUkRvYVh6Z","tokenType":"bearer","expiresIn":3600,"scope":"hrn:here:authorization::myorg:project/myproject"}}}},"400":{"description":"See https://tools.ietf.org/html/rfc6749#section-5.2 for allowed error response error parameter values. An error has occurred.\n* 400200 - Received invalid data. See 'errorFields' for more information.\n  * errorFields.errorCode 400208: Not a number.\n  * errorFields.errorCode 400209: Value too small\n  * errorFields.errorCode 400290: Illegal grant type.\n  * errorFields.errorCode 400907: Missing required 'openid' scope\n  * errorFields.errorCode 400909: Invalid character in scope field.\n  * errorFields.errorCode 400927: Scope is invalid.\n* 400981 -  Only one project scope allowed in token.\n","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Rfc6749ErrorMessage"}}}},"401":{"description":"An error has occurred.\n","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}}},"403":{"description":"An error has occurred.\n* 403109 - Client is not a member of the project.\n","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}}},"412":{"description":"Precondition failed, further user action required.","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SignInPreconditionFailedResponse"}}},"links":{"acceptTermsLink":{"$ref":"#/components/links/acceptTermsLink"}}}},"security":[{"OAuth":[]},{"Bearer":[]},{}]}},"/tokens":{"delete":{"tags":["Device Token Management"],"summary":"Revoke a HERE device access token that was obtained via token exchange.","operationId":"OAuth 2.0 Access Token deleteDeviceToken","description":"Revoke the HERE device access token, provided in the Authorization: Bearer header for this request, \nthat was previously obtained via token exchange API.\n","responses":{"204":{"description":"No Content","headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}}},"400":{"description":"Bad Request.\n* E110000 - Missing required field, etc.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorMessage"}}},"headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}}},"401":{"description":"Missing or invalid Authorization header.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorMessage"}}},"headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}}},"403":{"description":"An error has occurred.\n* E110000 - Token does not support deletion.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorMessage"}}},"headers":{"X-Correlation-ID":{"$ref":"#/components/headers/XCorrelationId"},"X-Request-ID":{"$ref":"#/components/headers/XRequestId"}}}}}}},"components":{"responses":{"CommonError":{"description":"An error occurred while processing the request. The following common error codes apply to all endpoints.\n## General Error Codes\n* httpStatus 400, errorCode 400002: Invalid JSON.\n* httpStatus 400, errorCode 400003: Content-Type header missing.\n* httpStatus 400, errorCode 400004: Content-Type header something else than 'application/json'.\n* httpStatus 400, errorCode 400200: Received invalid data. See 'errorFields' for more information.\n  * errorFields.errorCode 400201: Missing required field. 'errorFields.name' describes which field was missing.\n  * errorFields.errorCode 400202: Value cannot be empty. 'errorFields.name' describes which field was empty.\n  * errorFields.errorCode 400203: Invalid value. 'errorFields.name' describes which field had illegal characters (Illegal characters are all control characters, non-breaking space, and * / < > \\ | )\n  * errorFields.errorCode 400204: Invalid system generated value. 'errorFields.name' describes which field had illegal characters.\n  * errorFields.errorCode 400216: Not a valid array value. 'errorFields.name' describes which field was expecting an array value.\n  * errorFields.errorCode 400217: Not a valid string value. 'errorFields.name' describes which field was expecting a string value.\n  * errorFields.errorCode 400218: Not a valid JSON object. 'errorFields.name' describes which field was expecting a JSON object value.\n* httpStatus 400, errorCode 400255: Invalid realm format.\n* httpStatus 400, errorCode 400917: Unable to perform request. Size limit exceeded.\n* httpStatus 401, errorCode 401300: Invalid client credentials.\n* httpStatus 401, errorCode 401302: Client does not have access to the endpoint.\n* httpStatus 401, errorCode 401424: Access key has been disabled.\n* httpStatus 429, errorCode 429002: Request blocked because too many requests were made. Please wait for a while before making a new request.\n## Token Validation Error Codes\n* httpStatus 401, errorCode 400300: Invalid characters in access token.\n* httpStatus 401, errorCode 400601: Unsupported token format.\n* httpStatus 401, errorCode 400600: Expired token.\n* httpStatus 401, errorCode 401200: Authorization header missing.\n* httpStatus 401, errorCode 401201: Invalid Authorization header format, expecting Bearer format.\n* httpStatus 401, errorCode 401303: Wrong token type. (example: passed user token in place of client token)\n* httpStatus 401, errorCode 401701: Access Token no longer valid.\n* httpStatus 401, errorCode 401600: No account found for given account Id.\n* httpStatus 401, errorCode 401510: User: {ID} has expired.\n* httpStatus 401, errorCode 401500: User: {ID} is not enabled.\n* httpStatus 401, errorCode 404660: No app exists with the given Id.\n* httpStatus 401, errorCode 401311: Requesting client status is not active.\n## Client Signed Request Error Codes\n* httpStatus 401, errorCode 401202: Malformed OAuth 1.0 header (ex. duplicated parameters, missing parameters).\n* httpStatus 401, errorCode 401204: Time stamp is outside the valid period.\n* httpStatus 401, errorCode 401205: Unsupported value for signature method.\n* httpStatus 401, errorCode 401206: Unsupported value for \"oauth_version\" parameter - should be 1.0.\n* httpStatus 401, errorCode 401207: Nonce already consumed.\n* httpStatus 401, errorCode 401300: Invalid client credentials / signature mismatch.\n* httpStatus 401, errorCode 401310: Invalid signature. Attempt to use client ID instead of access key identifier for consumer key.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}},"headers":{"XCorrelationId":{"schema":{"type":"string"},"required":false,"description":"The X-Correlation-ID for the request, used to track this request in the platform. X-Correlation-ID value is propagated throughout the platform."},"XRequestId":{"schema":{"type":"string"},"required":false,"description":"The unique id for the request, used to track this request within the service. X-Request-ID value is NOT propagated to the downstream services."}},"schemas":{"ErrorResponse":{"type":"object","properties":{"errorId":{"type":"string","description":"Unique id for the error. This is searchable from HERE Account logs.","example":"ERROR-9d862c5a-4cfd-4780-8be4-2728b42849e1"},"httpStatus":{"type":"integer","description":"HTTP status code of the response","example":401},"errorCode":{"type":"integer","description":"Error code representing the specific error. If the 'errorFields' element is present, it will have precise error codes.\n","example":401300},"message":{"type":"string","description":"Descriptive message to help with development.  Note that the value of this field is **NOT** guaranteed to be consistent across releases and should **NOT** be coded against.\n","example":"Invalid client credentials."},"errorFields":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string","description":"Name of the field that had an error. Will be blank in case the error was caused when comparing multiple fields.\n","example":"Received invalid data.  See json element 'errorFields' for more information."},"errorCode":{"type":"integer","description":"More detailed error code. Needs to be paired with 'errorFields.name' to get the exact error.\n","example":400201},"message":{"type":"string","description":"Descriptive message to help with development.  Note that the value of this field is **NOT** guaranteed to be consistent across releases and should **NOT** be coded against.\n","example":"This field is required."}}}}}},"AuthServerMetadata":{"type":"object","properties":{"issuer":{"type":"string","format":"uri","description":"The authorization server's issuer identifier.","example":"https://account.api.here.com"},"token_endpoint":{"type":"string","format":"uri","description":"URL of authorization servers’s token endpoint","example":"https://account.api.here.com/oauth2/token"},"token_endpoint_auth_methods_supported":{"type":"array","items":{"type":"string","enum":["private_key_jwt"]},"description":"JSON array containing a list of client authentication methods supported by this token endpoint.","example":["private_key_jwt"]},"token_endpoint_auth_signing_alg_values_supported":{"type":"array","items":{"type":"string","enum":["RS256"]},"description":"JSON array containing a list of the JWS signing algorithms (\"alg\" values) supported by the token endpoint for the signature on the JWT","example":["RS256"]},"grant_types_supported":{"type":"array","items":{"type":"string","enum":["client_credentials","jwtIssNotHERE","urn:ietf:params:oauth:grant-type:token-exchange"]},"description":"JSON array containing a list of the OAuth 2.0 grant type values that this authorization server supports.","example":["client_credentials"]},"response_types_supported":{"type":"array","items":{"type":"string","enum":["token"]},"description":"JSON array containing a list of the OAuth 2.0 response_type values. Supported values 'token'","example":["token"]}}},"MCPAuthServerMetadata":{"type":"object","properties":{"issuer":{"type":"string","format":"uri","description":"The authorization server's MCP issuer identifier.","example":"https://account.here.com"},"authorization_endpoint":{"type":"string","format":"uri","description":"URL of authorization servers’s MCP authorization endpoint","example":"https://account.here.com/mcp/authorize"},"token_endpoint":{"type":"string","format":"uri","description":"URL of authorization servers’s token endpoint","example":"https://account.here.com/token"},"registration_endpoint":{"type":"string","format":"uri","description":"URL of authorization servers’s MCP client registration endpoint","example":"https://account.api.here.com/mcp/register"},"token_endpoint_auth_methods_supported":{"type":"array","items":{"type":"string","enum":["none"]},"description":"JSON array containing a list of client authentication methods supported by this token endpoint.","example":["none"]},"grant_types_supported":{"type":"array","items":{"type":"string","enum":["authorization_code"]},"description":"JSON array containing a list of the OAuth 2.0 grant type values that this authorization server supports.","example":["authorization_code"]},"response_types_supported":{"type":"array","items":{"type":"string","enum":["code"]},"description":"JSON array containing a list of the OAuth 2.0 response_type values. Supported values 'code'","example":["code"]},"jwks_uri":{"type":"string","format":"uri","description":"URL of the authorization server's JSON Web Key Set document.","example":"https://account.here.com/openid/jwk"},"code_challenge_methods_supported":{"type":"array","items":{"type":"string"},"description":"PKCE code challenge methods supported by the server. Only SHA-256 (S256) is supported.","example":["S256"]}}},"McpClientRegistrationRequest":{"type":"object","required":["client_name","redirect_uris"],"properties":{"client_name":{"type":"string","maxLength":256,"description":"Human-readable client name. Shown on the consent screen.\n","example":"Kiro"},"redirect_uris":{"type":"array","minItems":1,"maxItems":10,"items":{"type":"string","pattern":"^https://[^/?#]+(?:/[^#]*)?$|^http://(?:localhost|127\\.0\\.0\\.1|\\[::1\\])(?::\\d+)?(?:/[^#]*)?$"},"description":"Redirection URIs. Must be HTTPS (non-loopback) or loopback HTTP (http://localhost, http://127.0.0.1, http://[::1]) only. No wildcards, no fragments. Validated against application_type at registration and exact-matched at authorize/token time.\n","example":["http://127.0.0.1:63749/oauth/callback"]},"token_endpoint_auth_method":{"type":"string","enum":["none"],"description":"Must be \"none\" if supplied. The server always provisions a public (PKCE-only) client and issues no client_secret. Defaults to [\"none\"]\n","example":"none"},"grant_types":{"type":"array","items":{"type":"string","enum":["authorization_code"]},"description":"Only authorization code supported for Public MCP Clients. Any other value (e.g. client_credentials, implicit) is rejected with invalid_client_metadata. Defaults to [\"authorization_code\"]\n","example":["authorization_code"]},"response_types":{"type":"array","items":{"type":"string","enum":["code"]},"description":"Must be \"code\" if supplied. Defaults to [\"code\"].","example":["code"]}}},"McpClientRegistrationResponse":{"type":"object","properties":{"client_id":{"type":"string","description":"Server-assigned client identifier.","example":"test-mcp-app-1a2b3c4d"},"client_id_issued_at":{"type":"integer","format":"int64","description":"Epoch seconds at which the client_id was issued.","example":1783036055},"client_name":{"type":"string","description":"Human-readable client name. Shown on the consent screen.\n","example":"Kiro"},"redirect_uris":{"type":"array","items":{"type":"string"},"description":"Redirection URIs from request body. Must be HTTPS (non-loopback) or loopback HTTP\n","example":["http://127.0.0.1:63749/oauth/callback"]},"grant_types":{"type":"array","items":{"type":"string"},"description":"Only authorization code supported for Public MCP Clients.\n","example":["authorization_code"]},"response_types":{"type":"array","items":{"type":"string"},"example":["code"],"description":"JSON array containing a list of the OAuth 2.0 response_type values. Supported values 'code'"},"token_endpoint_auth_method":{"type":"string","description":"Token endpoint authentication method. Must be \"none\" if supplied.\n","example":"none"}}},"SignInRequestJson":{"oneOf":[{"$ref":"#/components/schemas/SignInWithClientCredentialsRequestJson"},{"$ref":"#/components/schemas/OidcSignInRequestJson"},{"$ref":"#/components/schemas/TokenExchangeRequestJson"}]},"SignInRequestForm":{"oneOf":[{"$ref":"#/components/schemas/SignInWithClientCredentialsRequestForm"},{"$ref":"#/components/schemas/OidcSignInRequestForm"},{"$ref":"#/components/schemas/TokenExchangeRequestForm"}]},"SignInResponse":{"oneOf":[{"$ref":"#/components/schemas/SignInResponseJson"},{"$ref":"#/components/schemas/SignInResponseForm"}]},"SignInResponseJson":{"oneOf":[{"$ref":"#/components/schemas/SignInWithClientCredentialsResponseJson"},{"$ref":"#/components/schemas/SignInWithOidcResponseJson"},{"$ref":"#/components/schemas/TokenExchangeResponseJson"}]},"SignInResponseForm":{"oneOf":[{"$ref":"#/components/schemas/SignInWithClientCredentialsResponseForm"},{"$ref":"#/components/schemas/SignInWithOidcResponseForm"},{"$ref":"#/components/schemas/TokenExchangeResponseForm"}]},"SignInWithClientCredentialsRequestForm":{"type":"object","required":["grant_type"],"properties":{"grant_type":{"type":"string","description":"Always \"client_credentials\" for this operation.","enum":["client_credentials"],"example":"client_credentials"},"client_assertion_type":{"type":"string","description":"The type of client assertion being used for authentication. When present, OAuth 1.0 signature\nheaders are NOT required. Must be \"urn:ietf:params:oauth:client-assertion-type:jwt-bearer\" per RFC 7523.\nRequired when client_assertion is provided.\n","enum":["urn:ietf:params:oauth:client-assertion-type:jwt-bearer"],"example":"urn:ietf:params:oauth:client-assertion-type:jwt-bearer"},"client_assertion":{"type":"string","description":"A single signed JWT used to authenticate the client (RFC 7523 §2.2). When present along with\nclient_assertion_type, OAuth 1.0 signature headers are NOT required.\n\nThe JWT MUST contain the following claims:\n* iss: REQUIRED. The client_id of the application.\n* sub: REQUIRED. Must equal iss (the client_id of the application).\n* aud: REQUIRED. The token endpoint URL.\n* exp: REQUIRED. Expiration time (NumericDate). The AS MAY reject tokens with exp unreasonably far in the future.\n* iat: OPTIONAL. Issued at time (NumericDate).\n* jti: OPTIONAL. Unique assertion id. When provided, it is used for replay protection and MUST only be used once.\n\nThe JWT header MUST contain:\n* alg: REQUIRED. The signing algorithm (e.g. RS256).\n* kid: OPTIONAL. Key ID matching a registered public key. When provided, it is used to identify which registered JWK to verify against.\n\nThe JWT MUST be signed with a private key whose corresponding public key is registered for the\napplication via the JWKs management API. The JWT header MUST include the kid matching the registered key.\n","example":"eyJhbGciOiJSUzI1NiIsImtpZCI6InJzYS1zaWduaW5nLWtleS0yMDI2In0.eyJpc3MiOiJ1SWtHellTaExLdFFRQWltWHp2ViIsInN1YiI6InVJa0d6WVNoTEt0UVFBaW1YenZWIiwiYXVkIjoiaHR0cHM6Ly9hY2NvdW50LmFwaS5oZXJlLmNvbS9vYXV0aDIvdG9rZW4iLCJleHAiOjE3NDg0MzgwMDAsImlhdCI6MTc0ODQzNDQwMCwianRpIjoiYTFiMmMzZDQtZTVmNi03ODkwIn0.signature"},"expires_in":{"type":"integer","example":3600,"description":"Number of seconds before token expires, must number zero or more.  Ignored if greater than default expiration of the application.\n"},"token_format":{"type":"string","example":"hN","enum":["hN","jwt","jwt+header","jws"],"description":"Supported token formats are hN, jwt, jwt+header and jws.\n* 'hN' produces a HERE proprietary-formatted access token.\n* 'jwt' produces a Nested JWT-formatted access token with a JWE enclosed in a JWS.\n* 'jwt+header' produces a Nested JWT-formatted access token with a JWE enclosed in a JWS with additional claims copied into the JOSE header.\n* 'jws' produces a JWS-formatted access token with a JWS Payload containing the *plaintext* JWT Claims Set.\n"},"scope":{"type":"string","description":"Requested scope of the access token. Must be an HRN identifying a project that the identified client has access to.\n","example":"hrn:here:authorization::myrealm:project/myproject"},"device_id":{"type":"string","description":"Anonymous Device id. Supported only if client has deviceTokenCreationEnabled flag enabled. On success, token will contain 'did' claim.\n","example":"7f911ae9-3f11-4ad3-8bb0-b3436cc0f3bf"},"resource":{"type":"array","items":{"type":"string","pattern":"^https?://[^/?#]+(?:/[^?#]*)?$","example":"https://here.com/mcp"},"description":"Parameter to indicate the resource server for which the access token is requested. \nThe resource parameter value must be <ol> <li>Must be canonical service URI</li> <li>Must contain the scheme</li> <li>Must contain host</li> <li>May contain path component</li>  <li>May contain trialing slash</li> <li>Letters may be of uppercase and lowercase form</li>  <li>Should NOT contain query parameters</li> <li>Must NOT contain fragments</li>\n"}}},"SignInWithClientCredentialsRequestJson":{"type":"object","required":["grantType"],"properties":{"grantType":{"type":"string","description":"Always \"client_credentials\" for this operation.","enum":["client_credentials"],"example":"client_credentials"},"clientAssertionType":{"type":"string","description":"The type of client assertion being used for authentication. When present, OAuth 1.0 signature\nheaders are NOT required. Must be \"urn:ietf:params:oauth:client-assertion-type:jwt-bearer\" per RFC 7523.\nRequired when clientAssertion is provided.\n","enum":["urn:ietf:params:oauth:client-assertion-type:jwt-bearer"],"example":"urn:ietf:params:oauth:client-assertion-type:jwt-bearer"},"clientAssertion":{"type":"string","description":"A single signed JWT used to authenticate the client (RFC 7523 §2.2). When present along with\nclientAssertionType, OAuth 1.0 signature headers are NOT required.\n\nThe JWT MUST contain the following claims:\n* iss: REQUIRED. The client_id of the application.\n* sub: REQUIRED. Must equal iss (the client_id of the application).\n* aud: REQUIRED. The token endpoint URL (e.g. https://account.api.here.com/oauth2/token).\n* exp: REQUIRED. Expiration time (NumericDate). The AS MAY reject tokens with exp unreasonably far in the future.\n* iat: OPTIONAL. Issued at time (NumericDate).\n* jti: OPTIONAL. Unique assertion id. When provided, it is used for replay protection and MUST only be used once.\n\nThe JWT header MUST contain:\n* alg: REQUIRED. The signing algorithm (e.g. RS256, ES256).\n* kid: OPTIONAL. Key ID matching a registered public key. When provided, it is used to identify which registered JWK to verify against.\n\nThe JWT MUST be signed with a private key whose corresponding public key is registered for the\napplication via the JWKs management API. The JWT header MUST include the kid matching the registered key.\n","example":"eyJhbGciOiJSUzI1NiJ9.eyJpc3Mi[...omitted for brevity...].cC4hiUPo[...omitted for brevity...]"},"expiresIn":{"type":"integer","example":3600,"description":"Number of seconds before token expires, must number zero or more. Ignored if greater than default expiration of the application.\n"},"tokenFormat":{"type":"string","enum":["hN","jwt","jwt+header","jws"],"example":"hN","description":"Supported token formats are hN, jwt, jwt+header and jws.\n* 'hN' produces a HERE proprietary-formatted access token.\n* 'jwt' produces a Nested JWT-formatted access token with a JWE enclosed in a JWS.\n* 'jwt+header' produces a Nested JWT-formatted access token with a JWE enclosed in a JWS with additional claims copied into the JOSE header.\n* 'jws' produces a JWS-formatted access token with a JWS Payload containing the *plaintext* JWT Claims Set.\n"},"scope":{"type":"string","description":"Requested scope of the access token. Must be an HRN identifying a project that the identified client has access to.\n","example":"hrn:here:authorization::myrealm:project/myproject"},"deviceId":{"type":"string","description":"Anonymous Device id. Supported only if client has deviceTokenCreationEnabled flag enabled. On success, token will contain 'did' claim.\n","example":"7f911ae9-3f11-4ad3-8bb0-b3436cc0f3bf"},"resource":{"type":"array","items":{"type":"string","pattern":"^https?://[^/?#]+(?:/[^?#]*)?$","example":"https://here.com/mcp"},"description":"Parameter to indicate the resource server for which the access token is requested. \n\nThe resource parameter value must be <ol> <li>Must be canonical service URI</li> <li>Must contain the scheme</li> <li>Must contain host</li> <li>May contain path component</li>  <li>May contain trialing slash</li> <li>Letters may be of uppercase and lowercase form</li>  <li>Should NOT contain query parameters</li> <li>Must NOT contain fragments</li>\n"}}},"SignInWithClientCredentialsResponseJson":{"type":"object","properties":{"accessToken":{"type":"string","description":"The new client access token, identifying your service..","example":"eyJhbGciOiJSUzUxMiIsImN0e...x1dEEtSlJ4eFBvOEREZzJyeVFHOU9pUkRvYVh6Z"},"tokenType":{"type":"string","description":"Always \"bearer\" for this operation..","example":"Bearer"},"expiresIn":{"type":"integer","description":"Seconds until token expiration.","example":3600},"scope":{"type":"string","description":"Optional. The scope assigned to the access token.","example":"hrn:here:authorization::myrealm:project/myproject"},"deviceId":{"type":"string","description":"Optional. Included only if the client has deviceTokenCreationEnabled flag enabled and the request contains the deviceId\n","example":"7f911ae9-3f11-4ad3-8bb0-b3436cc0f3bf"}}},"SignInWithClientCredentialsResponseForm":{"type":"object","properties":{"access_token":{"type":"string","description":"The new client access token, identifying your service..","example":"eyJhbGciOiJSUzUxMiIsImN0e...x1dEEtSlJ4eFBvOEREZzJyeVFHOU9pUkRvYVh6Z"},"token_type":{"type":"string","description":"Always \"bearer\" for this operation..","example":"Bearer"},"expires_in":{"type":"integer","description":"Seconds until token expiration.","example":3600},"scope":{"type":"string","description":"Optional. The scope assigned to the access token.","example":"hrn:here:authorization::myrealm:project/myproject"},"device_id":{"type":"string","description":"Optional. Included only if the client has deviceTokenCreationEnabled flag enabled and the request contains the deviceId\n","example":"7f911ae9-3f11-4ad3-8bb0-b3436cc0f3bf"}}},"OidcSignInRequestJson":{"type":"object","title":"OidcSignInRequestJson","properties":{"grantType":{"type":"string","description":"Always \"jwtIssNotHERE\" for this operation.\n","example":"jwtIssNotHERE"},"clientId":{"type":"string","description":"HERE issued client that is initiating this federation. Required for OIDC federation.\n","example":"CAAKe98vpnuPAZDZD"},"realm":{"type":"string","description":"realm in which this token exchange happens. Required for OIDC federation.","example":"olp-oem"},"givenName":{"type":"string","description":"User's first name. Required when exchanging some types of third party tokens and when this is the first time sign-in; optional for subsequent sign-ins.","example":"Jack"},"familyName":{"type":"string","description":"User's last name. Required when exchanging some types of third party tokens and when this is the first time sign-in; optional for subsequent sign-ins.","example":"Harrow"},"countryCode":{"type":"string","descriptio

# --- truncated at 32 KB (55 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/here/refs/heads/main/openapi/here-oauth2-token-v1-openapi.yml