DTN · OAuth Scopes
DTN OAuth Scopes
OAuth 2.0
derived
DTN uses OAuth 2.0 but publishes no discrete scopes — access is governed by the grant itself (e.g. client-credentials or role-based authorization) rather than per-scope consent.
Tokens are issued from https://api.auth.dtn.com/v1/tokens/authorize.
This index is generated from the provider’s OpenAPI security definitions (and, where available, its documented scope reference) and refreshes on every APIs.io network build. Browse every provider’s scopes at scopes.apis.io.
WeatherAgricultureEnergyMarket DataAviationMarineForecastingObservationsCommodities
Scopes: 0
Flows: clientCredentials
Method: derived
OAuth endpoints
Token URL
https://api.auth.dtn.com/v1/tokens/authorize
https://api.auth.dtn.com/v1/tokens/authorize
Flows
clientCredentials
clientCredentials
Scopes (0)
DTN implements OAuth 2.0 but publishes no discrete scopes — access is governed by the grant itself (client-credentials or role-based authorization) rather than per-scope consent.
Source
OAuth Scopes
generated: '2026-07-22'
method: derived
source: openapi/dtn-agency-bulletin-api-openapi.json, openapi/dtn-agency-bulletin-websocket-api-openapi.json,
openapi/dtn-alerting-api-openapi.json, openapi/dtn-astronomical-api-openapi.json, openapi/dtn-climatology-api-openapi.json,
openapi/dtn-developer-portal-api-openapi.json, openapi/dtn-digital-commerce-orders-openapi.json,
openapi/dtn-energy-digital-commerce-integrations-api-openapi.json, openapi/dtn-energy-event-index-api-openapi.json,
openapi/dtn-enhanced-flight-hazards-api-openapi.json, openapi/dtn-farm-intel-api-openapi.json,
openapi/dtn-financial-market-data-openapi.json, openapi/dtn-lightning-api-openapi.json, openapi/dtn-lightning-websocket-openapi.json,
openapi/dtn-map-tile-api-openapi.json, openapi/dtn-marine-weather-api-openapi.json, openapi/dtn-metars-api-openapi.json,
openapi/dtn-notams-api-openapi.json, openapi/dtn-observation-api-openapi.json, openapi/dtn-pavement-conditions-api-openapi.json,
openapi/dtn-pireps-api-openapi.json, openapi/dtn-precipitation-api-openapi.json, openapi/dtn-probabilistic-api-openapi.json,
openapi/dtn-radarscope-radar-products-openapi.json, openapi/dtn-refined-fuels-demand-openapi.json,
openapi/dtn-renewables-api-openapi.json, openapi/dtn-shipping-api-openapi.json, openapi/dtn-sigmets-airmets-openapi.json,
openapi/dtn-soil-api-openapi.json, openapi/dtn-storm-impact-analytics-openapi.json, openapi/dtn-storm-risk-analytics-api-openapi.json,
openapi/dtn-tafs-api-openapi.json, openapi/dtn-tropical-api-openapi.json, openapi/dtn-weather-conditions-api-openapi.json,
openapi/dtn-websocket-api-openapi.json, openapi/dtn-windsaloft-api-openapi.json
schemes:
- name: clientCredentials
source: openapi/dtn-agency-bulletin-api-openapi.json
flows:
- flow: clientCredentials
tokenUrl: https://api.auth.dtn.com/v1/tokens/authorize
description: "# Using DAIS for M2M/API Auth\nYou have been given a Client ID and a Client\
\ Secret, which are used to request a DTN Access Token. DTN Access Tokens are required when\
\ making calls to each and every DTN API endpoint. The following information provides additional\
\ details on these tokens and how they are generated.\n## What is an Access Token and how\
\ is it different from an API Key?\nAn API Key is a random string of characters that an\
\ API uses to authorize whether or not a calling client has approved access to an endpoint.\
\ These keys are a non-standard approach to API authorization and are generally issued on\
\ a per-API basis.\n\nAn Access Token is also a string of characters but is a base-64 encoded\
\ JavaScript Object Notation Web Token, or JWT. JWTs are a widely accepted standard that\
\ use OAuth concepts and approaches. \n\nBoth API Keys and Access Tokens are used in an\
\ Authorization Request Header as a Bearer, meaning there is no difference in where you\
\ put this string of characters when you make calls to DTN APIs.\n## How to generate an\
\ Access Token?\nWhen requested, an Access Token is generated for your specific Client (ID/Secret)\
\ and for a specific API. The DTN Auth and Identity Service (DAIS) generates new Access\
\ Tokens for your client. The DAIS endpoint is `POST https://api.auth.dtn.com/v1/tokens/authorize`.\n\
\nThis endpoint takes two Header parameters:\n * `Content-Type: application/json`\n *\
\ `Accept: application/json`\n\nThis endpoint takes four parameters in the Request Body:\n\
\ * `grant_type`: this should always be client_credentials for generating machine-to-machine\
\ tokens.\n * `client_id`: this is the Client ID or Application ID using the token and\
\ is given to you by DTN's Identity Team. This ID will never change for your client/application.\n\
\ * `client_secret`: this is the Client Secret that is associated with the Application\
\ ID and is given to you by DTN's Identity Team. This key is subject to rotation for security\
\ purposes but always with the client's knowledge.\n * `audience`: this is the API for\
\ which this Access Token will be used. For the DTN Agency Bulletin API, you need to use\
\ the following audience: https://weather.api.dtn.com\n\nYou can use this CURL command template\
\ as a reference for obtaining an access token:\n ```\n curl --location --request POST\
\ 'https://api.auth.dtn.com/v1/tokens/authorize' \\\n--header 'Accept: application/json'\
\ \\\n--header 'Content-Type: application/json' \\\n--data-raw '{\n\"grant_type\": \"client_credentials\"\
,\n\"client_id\": \"insert your client id here\",\n\"client_secret\": \"insert your client\
\ secret here\",\n\"audience\": \"insert your audience here\"\n}' \n ```\n\n*This document,\
\ for demonstration purposes, supplies a client_id and client_secret in all code examples.\
\ This client/application is for a fictitious API and cannot be used in practice to gain\
\ unauthorized access to any other DTN API.*\nUpon generating a new Access Token, you should\
\ receive an HTTP Response from DAIS similar to this:\n ```\n {\n \"data\": {\n \
\ \"access_token\": \"eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6InpfX21pZW13NGhoTmdvQWQxR3N6ciJ9.eyJodHRwczovL2F1dGguZHRuLmNvbS9jdXN0b21lcklkIjoiMTIzNDU2Nzg5MERlbW8iLCJodHRwczovL2F1dGguZHRuLmNvbS9wcm9kdWN0Q29kZSI6IkRlbW9BcGlQIiwiaHR0cHM6Ly9hdXRoLmR0bi5jb20vcmVxdWVzdGVySXAiOiIxOC4yMTMuMTc0LjI3IiwiaHR0cHM6Ly9hdXRoLmR0bi5jb20vcnBzIjoiMTAwIiwiaHR0cHM6Ly9hdXRoLmR0bi5jb20vdGllciI6IkJhc2ljIiwiaHR0cHM6Ly9hdXRoLmR0bi5jb20vcXVvdGEiOiI5OTk5OTkiLCJpc3MiOiJodHRwczovL2lkLmF1dGguZHRuLmNvbS8iLCJzdWIiOiJuZnlPM0tpS1BSOE4wREtSNUNMOGpTOUdGQkNEZXlGTUBjbGllbnRzIiwiYXVkIjoiaHR0cHM6Ly9kZW1vLWFwaS5hdXRoLmR0bi5jb20vIiwiaWF0IjoxNjU2MDk5MDY4LCJleHAiOjE2NTYwOTkxNTgsImF6cCI6Im5meU8zS2lLUFI4TjBES1I1Q0w4alM5R0ZCQ0RleUZNIiwic2NvcGUiOiJyZWFkOmRlbW8gY3JlYXRlOmRlbW8gdXBkYXRlOmRlbW8iLCJndHkiOiJjbGllbnQtY3JlZGVudGlhbHMiLCJwZXJtaXNzaW9ucyI6WyJyZWFkOmRlbW8iLCJjcmVhdGU6ZGVtbyIsInVwZGF0ZTpkZW1vIl19.0VHdyp1w9PPFVI0FPheAwuKZwb5C25rwP-LPMXcSNoRmouvga1DZtNLA67ZzE_sAlc_VpaDRr6daLKr_Alw4347mw9sdjP8wKR27kCZa9JZK5PGQMmXHscATbzBEJYpCPklfyGaajgymqTBGnedcv8F0UvlRzQPsFeRPnVoX7BWOSXpMbyToGiXWkQLBQT7r96KAmLZOPJFZspPtjw-wH2mSL2WNa_nkB4j5vMGhGxlKiNRsKb30TH_WAel2hsxNlcPK3XHCmrMTYsNnu7HNqOTMn2i0__0rvBrhSWEw-_grqQDmWFJuWd7Qhi1q81AaJcdqgoSa_efz93QFclJUNw\"\
,\n \"scope\": \"read:demo create:demo update:demo\",\n \"expires_in\"\
: 90,\n \"token_type\": \"Bearer\"\n },\n \"meta\": {\n \"date_time\"\
: \"2022-06-24T19:09:42.963Z\",\n \"name\": \"v1.tokens.authorize\",\n \
\ \"uuid\": \"ee6f9feb-dcf8-4421-a6fd-efd6beabdaa9\",\n \"start_timestamp\": 1656097782509,\n\
\ \"end_timestamp\": 1656097782963,\n \"execution_time\": 454\n }\n\
\ }\n ```\nLooking at this Response, you will see:\n * `access_token`: contains the JWT\
\ Access Token string you will use as your Bearer token.\n * `scope`: contains the scopes\
\ that this Access Token gives you permissions to access.\n * `expires_in`: contains the\
\ length of time before this Access Token will expire, in seconds.\n * `token_type`: verifies\
\ that this Access Token should be used as a Bearer token.\n\n## How to use an Access Token\
\ after one is generated?\nOnce a new Access Token is obtained, it is used in each call\
\ to a DTN API endpoint as a Bearer token in an Authorization Request Header. For example:\n\
\ ```\n Header: 'Authorization: Bearer eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6InpfX21pZW13NGhoTmdvQWQxR3N6ciJ9.eyJodHRwczovL2F1dGguZHRuLmNvbS9jdXN0b21lcklkIjoiMTIzNDU2Nzg5MERlbW8iLCJodHRwczovL2F1dGguZHRuLmNvbS9wcm9kdWN0Q29kZSI6IkRlbW9BcGlQIiwiaHR0cHM6Ly9hdXRoLmR0bi5jb20vcmVxdWVzdGVySXAiOiIxOC4yMTMuMTc0LjI3IiwiaHR0cHM6Ly9hdXRoLmR0bi5jb20vcnBzIjoiMTAwIiwiaHR0cHM6Ly9hdXRoLmR0bi5jb20vdGllciI6IkJhc2ljIiwiaHR0cHM6Ly9hdXRoLmR0bi5jb20vcXVvdGEiOiI5OTk5OTkiLCJpc3MiOiJodHRwczovL2lkLmF1dGguZHRuLmNvbS8iLCJzdWIiOiJuZnlPM0tpS1BSOE4wREtSNUNMOGpTOUdGQkNEZXlGTUBjbGllbnRzIiwiYXVkIjoiaHR0cHM6Ly9kZW1vLWFwaS5hdXRoLmR0bi5jb20vIiwiaWF0IjoxNjU2MDk5MDY4LCJleHAiOjE2NTYwOTkxNTgsImF6cCI6Im5meU8zS2lLUFI4TjBES1I1Q0w4alM5R0ZCQ0RleUZNIiwic2NvcGUiOiJyZWFkOmRlbW8gY3JlYXRlOmRlbW8gdXBkYXRlOmRlbW8iLCJndHkiOiJjbGllbnQtY3JlZGVudGlhbHMiLCJwZXJtaXNzaW9ucyI6WyJyZWFkOmRlbW8iLCJjcmVhdGU6ZGVtbyIsInVwZGF0ZTpkZW1vIl19.0VHdyp1w9PPFVI0FPheAwuKZwb5C25rwP-LPMXcSNoRmouvga1DZtNLA67ZzE_sAlc_VpaDRr6daLKr_Alw4347mw9sdjP8wKR27kCZa9JZK5PGQMmXHscATbzBEJYpCPklfyGaajgymqTBGnedcv8F0UvlRzQPsFeRPnVoX7BWOSXpMbyToGiXWkQLBQT7r96KAmLZOPJFZspPtjw-wH2mSL2WNa_nkB4j5vMGhGxlKiNRsKb30TH_WAel2hsxNlcPK3XHCmrMTYsNnu7HNqOTMn2i0__0rvBrhSWEw-_grqQDmWFJuWd7Qhi1q81AaJcdqgoSa_efz93QFclJUNw'\n\
\ ```\n\n## Deconstructing the Access Token\nA DTN Access Token carries information within\
\ its JWT Body that is available on every API call. By deconstructing the JWT token, our\
\ Access Tokens will resemble:\n ```\n {\n \"https://auth.dtn.com/customerId\": \"\
1234567890Demo\",\n \"https://auth.dtn.com/productCode\": \"DemoApiP\",\n \"https://auth.dtn.com/requesterIp\"\
: \"18.213.174.27\",\n \"https://auth.dtn.com/rps\": \"100\",\n \"https://auth.dtn.com/tier\"\
: \"Basic\",\n \"https://auth.dtn.com/quota\": \"999999\",\n \"iss\": \"https://id.auth.dtn.com/\"\
,\n \"sub\": \"nfyO3KiKPR8N0DKR5CL8jS9GFBCDeyFM@clients\",\n \"aud\": \"https://demo-api.auth.dtn.com/\"\
,\n \"iat\": 1656099068,\n \"exp\": 1656099158,\n \"azp\": \"nfyO3KiKPR8N0DKR5CL8jS9GFBCDeyFM\"\
,\n \"scope\": \"read:demo create:demo update:demo\",\n \"gty\": \"client-credentials\"\
,\n \"permissions\": [\n \"read:demo\",\n \"create:demo\",\n \"update:demo\"\
\n ]\n }\n ```\n### Description of Claims\n\n | Claim \
\ | Type | Description \
\ \
\ \
\ |\n | -----------------------------------| --------------------------------------------|\
\ ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|\n\
\ | `https://auth.dtn.com/customerId` | String |\
\ Custom DTN claim containing the Customer ID found in the DTN Order Management/Salesforce\
\ system associated with this token. \
\ |\n | `https://auth.dtn.com/productCode`\
\ | String | Custom DTN claim containing the Identity\
\ product code associated with this token. \
\ \
\ |\n | `https://auth.dtn.com/requesterIp` | String \
\ | Custom DTN claim containing the IP address of the requesting client. \
\ \
\ |\n | `https://auth.dtn.com/rps`\
\ | String | Custom DTN claim containing the\
\ maximum rate per second this customer is authorized to utilize. \
\ \
\ |\n | `https://auth.dtn.com/tier` | String \
\ | Custom DTN claim containing the data tier the customer purchased for\
\ the requested access. \
\ |\n | `https://auth.dtn.com/quota`\
\ | String | Custom DTN claim containing the\
\ maximum yearly quota the customer purchased for calling DTN endpoints for the specific\
\ product. \
\ |\n | `iss` | String (URI) \
\ | The Security Token Service (STS) that issues and returns the token.\
\ If this value is not from `https://id.auth.dtn.com/`, the token should not be considered\
\ trusted. |\n | `sub` \
\ | String (URI) | The principle about\
\ which the token asserts information (the User ID or Client ID within the Identity Provider).\
\ A User ID will start with a prefix of `auth0\\|`, while the Client ID will end with the\
\ suffix `@clients`. |\n | `aud` | String \\| Array (Strings)\
\ (URI \\| [URI, …]) | Identifies the intended recipient(s) of the token – its audience.\
\ The token should be rejected if the audience does not contain values expected by the calling\
\ application. |\n | `iat` \
\ | Number (Timestamp) | “Issued At” indicates\
\ when the authentication for this token occurred. \
\ \
\ |\n | `exp` | Number (Timestamp)\
\ | The “expiration time” on or after which the JWT must not be\
\ accepted for processing. \
\ |\n | `azp`\
\ | String | The application/client\
\ ID of the client using the token. The application can cat as itself or on behalf of a\
\ user. \
\ |\n | `gty` | String (Space-delimited)\
\ | The grant type that was used to request the token – not an RFC 7519\
\ registered claim (Auth0-specific). \
\ |\n | `permissions`\
\ | Array (Strings) | The grant type that\
\ was used to request the token – not an RFC 7519 registered claim (Auth0-specific). \
\ \
\ |"
- name: clientCredentials
source: openapi/dtn-agency-bulletin-websocket-api-openapi.json
flows:
- flow: clientCredentials
tokenUrl: https://api.auth.dtn.com/v1/tokens/authorize
description: "# Using DAIS for M2M/API Auth\nYou have been given a Client ID and a Client\
\ Secret, which are used to request a DTN Access Token. DTN Access Tokens are required when\
\ making calls to each and every DTN API endpoint. The following information provides additional\
\ details on these tokens and how they are generated.\n## What is an Access Token and how\
\ is it different from an API Key?\nAn API Key is a random string of characters that an\
\ API uses to authorize whether or not a calling client has approved access to an endpoint.\
\ These keys are a non-standard approach to API authorization and are generally issued on\
\ a per-API basis.\n\nAn Access Token is also a string of characters but is a base-64 encoded\
\ JavaScript Object Notation Web Token, or JWT. JWTs are a widely accepted standard that\
\ use OAuth concepts and approaches. \n\nBoth API Keys and Access Tokens are used in an\
\ Authorization Request Header as a Bearer, meaning there is no difference in where you\
\ put this string of characters when you make calls to DTN APIs.\n## How to generate an\
\ Access Token?\nWhen requested, an Access Token is generated for your specific Client (ID/Secret)\
\ and for a specific API. The DTN Auth and Identity Service (DAIS) generates new Access\
\ Tokens for your client. The DAIS endpoint is `POST https://api.auth.dtn.com/v1/tokens/authorize`.\n\
\nThis endpoint takes two Header parameters:\n * `Content-Type: application/json`\n *\
\ `Accept: application/json`\n\nThis endpoint takes four parameters in the Request Body:\n\
\ * `grant_type`: this should always be client_credentials for generating machine-to-machine\
\ tokens.\n * `client_id`: this is the Client ID or Application ID using the token and\
\ is given to you by DTN's Identity Team. This ID will never change for your client/application.\n\
\ * `client_secret`: this is the Client Secret that is associated with the Application\
\ ID and is given to you by DTN's Identity Team. This key is subject to rotation for security\
\ purposes but always with the client's knowledge.\n * `audience`: this is the API for\
\ which this Access Token will be used. For the DTN ABA WebSocket, you need to use the following\
\ audience: https://weather.api.dtn.com\n\nYou can use this CURL command template as a reference\
\ for obtaining an access token:\n ```\n curl --location --request POST 'https://api.auth.dtn.com/v1/tokens/authorize'\
\ \\\n--header 'Accept: application/json' \\\n--header 'Content-Type: application/json'\
\ \\\n--data-raw '{\n\"grant_type\": \"client_credentials\",\n\"client_id\": \"insert your\
\ client id here\",\n\"client_secret\": \"insert your client secret here\",\n\"audience\"\
: \"insert your audience here\"\n}' \n ```\n\n*This document, for demonstration purposes,\
\ supplies a client_id and client_secret in all code examples. This client/application is\
\ for a fictitious API and cannot be used in practice to gain unauthorized access to any\
\ other DTN API.*\nUpon generating a new Access Token, you should receive an HTTP Response\
\ from DAIS similar to this:\n ```\n {\n \"data\": {\n \"access_token\": \"\
eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6InpfX21pZW13NGhoTmdvQWQxR3N6ciJ9.eyJodHRwczovL2F1dGguZHRuLmNvbS9jdXN0b21lcklkIjoiMTIzNDU2Nzg5MERlbW8iLCJodHRwczovL2F1dGguZHRuLmNvbS9wcm9kdWN0Q29kZSI6IkRlbW9BcGlQIiwiaHR0cHM6Ly9hdXRoLmR0bi5jb20vcmVxdWVzdGVySXAiOiIxOC4yMTMuMTc0LjI3IiwiaHR0cHM6Ly9hdXRoLmR0bi5jb20vcnBzIjoiMTAwIiwiaHR0cHM6Ly9hdXRoLmR0bi5jb20vdGllciI6IkJhc2ljIiwiaHR0cHM6Ly9hdXRoLmR0bi5jb20vcXVvdGEiOiI5OTk5OTkiLCJpc3MiOiJodHRwczovL2lkLmF1dGguZHRuLmNvbS8iLCJzdWIiOiJuZnlPM0tpS1BSOE4wREtSNUNMOGpTOUdGQkNEZXlGTUBjbGllbnRzIiwiYXVkIjoiaHR0cHM6Ly9kZW1vLWFwaS5hdXRoLmR0bi5jb20vIiwiaWF0IjoxNjU2MDk5MDY4LCJleHAiOjE2NTYwOTkxNTgsImF6cCI6Im5meU8zS2lLUFI4TjBES1I1Q0w4alM5R0ZCQ0RleUZNIiwic2NvcGUiOiJyZWFkOmRlbW8gY3JlYXRlOmRlbW8gdXBkYXRlOmRlbW8iLCJndHkiOiJjbGllbnQtY3JlZGVudGlhbHMiLCJwZXJtaXNzaW9ucyI6WyJyZWFkOmRlbW8iLCJjcmVhdGU6ZGVtbyIsInVwZGF0ZTpkZW1vIl19.0VHdyp1w9PPFVI0FPheAwuKZwb5C25rwP-LPMXcSNoRmouvga1DZtNLA67ZzE_sAlc_VpaDRr6daLKr_Alw4347mw9sdjP8wKR27kCZa9JZK5PGQMmXHscATbzBEJYpCPklfyGaajgymqTBGnedcv8F0UvlRzQPsFeRPnVoX7BWOSXpMbyToGiXWkQLBQT7r96KAmLZOPJFZspPtjw-wH2mSL2WNa_nkB4j5vMGhGxlKiNRsKb30TH_WAel2hsxNlcPK3XHCmrMTYsNnu7HNqOTMn2i0__0rvBrhSWEw-_grqQDmWFJuWd7Qhi1q81AaJcdqgoSa_efz93QFclJUNw\"\
,\n \"scope\": \"read:demo create:demo update:demo\",\n \"expires_in\"\
: 90,\n \"token_type\": \"Bearer\"\n },\n \"meta\": {\n \"date_time\"\
: \"2022-06-24T19:09:42.963Z\",\n \"name\": \"v1.tokens.authorize\",\n \
\ \"uuid\": \"ee6f9feb-dcf8-4421-a6fd-efd6beabdaa9\",\n \"start_timestamp\": 1656097782509,\n\
\ \"end_timestamp\": 1656097782963,\n \"execution_time\": 454\n }\n\
\ }\n ```\nLooking at this Response, you will see:\n * `access_token`: contains the JWT\
\ Access Token string you will use as your Bearer token.\n * `scope`: contains the scopes\
\ that this Access Token gives you permissions to access.\n * `expires_in`: contains the\
\ length of time before this Access Token will expire, in seconds.\n * `token_type`: verifies\
\ that this Access Token should be used as a Bearer token.\n\n## How to use an Access Token\
\ after one is generated?\nOnce a new Access Token is obtained, it is used in each call\
\ to a DTN API endpoint as a Bearer token in an Authorization Request Header. For example:\n\
\ ```\n Header: 'Authorization: Bearer eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6InpfX21pZW13NGhoTmdvQWQxR3N6ciJ9.eyJodHRwczovL2F1dGguZHRuLmNvbS9jdXN0b21lcklkIjoiMTIzNDU2Nzg5MERlbW8iLCJodHRwczovL2F1dGguZHRuLmNvbS9wcm9kdWN0Q29kZSI6IkRlbW9BcGlQIiwiaHR0cHM6Ly9hdXRoLmR0bi5jb20vcmVxdWVzdGVySXAiOiIxOC4yMTMuMTc0LjI3IiwiaHR0cHM6Ly9hdXRoLmR0bi5jb20vcnBzIjoiMTAwIiwiaHR0cHM6Ly9hdXRoLmR0bi5jb20vdGllciI6IkJhc2ljIiwiaHR0cHM6Ly9hdXRoLmR0bi5jb20vcXVvdGEiOiI5OTk5OTkiLCJpc3MiOiJodHRwczovL2lkLmF1dGguZHRuLmNvbS8iLCJzdWIiOiJuZnlPM0tpS1BSOE4wREtSNUNMOGpTOUdGQkNEZXlGTUBjbGllbnRzIiwiYXVkIjoiaHR0cHM6Ly9kZW1vLWFwaS5hdXRoLmR0bi5jb20vIiwiaWF0IjoxNjU2MDk5MDY4LCJleHAiOjE2NTYwOTkxNTgsImF6cCI6Im5meU8zS2lLUFI4TjBES1I1Q0w4alM5R0ZCQ0RleUZNIiwic2NvcGUiOiJyZWFkOmRlbW8gY3JlYXRlOmRlbW8gdXBkYXRlOmRlbW8iLCJndHkiOiJjbGllbnQtY3JlZGVudGlhbHMiLCJwZXJtaXNzaW9ucyI6WyJyZWFkOmRlbW8iLCJjcmVhdGU6ZGVtbyIsInVwZGF0ZTpkZW1vIl19.0VHdyp1w9PPFVI0FPheAwuKZwb5C25rwP-LPMXcSNoRmouvga1DZtNLA67ZzE_sAlc_VpaDRr6daLKr_Alw4347mw9sdjP8wKR27kCZa9JZK5PGQMmXHscATbzBEJYpCPklfyGaajgymqTBGnedcv8F0UvlRzQPsFeRPnVoX7BWOSXpMbyToGiXWkQLBQT7r96KAmLZOPJFZspPtjw-wH2mSL2WNa_nkB4j5vMGhGxlKiNRsKb30TH_WAel2hsxNlcPK3XHCmrMTYsNnu7HNqOTMn2i0__0rvBrhSWEw-_grqQDmWFJuWd7Qhi1q81AaJcdqgoSa_efz93QFclJUNw'\n\
\ ```\n\n## Deconstructing the Access Token\nA DTN Access Token carries information within\
\ its JWT Body that is available on every API call. By deconstructing the JWT token, our\
\ Access Tokens will resemble:\n ```\n {\n \"https://auth.dtn.com/customerId\": \"\
1234567890Demo\",\n \"https://auth.dtn.com/productCode\": \"DemoApiP\",\n \"https://auth.dtn.com/requesterIp\"\
: \"18.213.174.27\",\n \"https://auth.dtn.com/rps\": \"100\",\n \"https://auth.dtn.com/tier\"\
: \"Basic\",\n \"https://auth.dtn.com/quota\": \"999999\",\n \"iss\": \"https://id.auth.dtn.com/\"\
,\n \"sub\": \"nfyO3KiKPR8N0DKR5CL8jS9GFBCDeyFM@clients\",\n \"aud\": \"https://demo-api.auth.dtn.com/\"\
,\n \"iat\": 1656099068,\n \"exp\": 1656099158,\n \"azp\": \"nfyO3KiKPR8N0DKR5CL8jS9GFBCDeyFM\"\
,\n \"scope\": \"read:demo create:demo update:demo\",\n \"gty\": \"client-credentials\"\
,\n \"permissions\": [\n \"read:demo\",\n \"create:demo\",\n \"update:demo\"\
\n ]\n }\n ```\n### Description of Claims\n\n | Claim \
\ | Type | Description \
\ \
\ \
\ |\n | -----------------------------------| --------------------------------------------|\
\ ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|\n\
\ | `https://auth.dtn.com/customerId` | String |\
\ Custom DTN claim containing the Customer ID found in the DTN Order Management/Salesforce\
\ system associated with this token. \
\ |\n | `https://auth.dtn.com/productCode`\
\ | String | Custom DTN claim containing the Identity\
\ product code associated with this token. \
\ \
\ |\n | `https://auth.dtn.com/requesterIp` | String \
\ | Custom DTN claim containing the IP address of the requesting client. \
\ \
\ |\n | `https://auth.dtn.com/rps`\
\ | String | Custom DTN claim containing the\
\ maximum rate per second this customer is authorized to utilize. \
\ \
\ |\n | `https://auth.dtn.com/tier` | String \
\ | Custom DTN claim containing the data tier the customer purchased for\
\ the requested access. \
\ |\n | `https://auth.dtn.com/quota`\
\ | String | Custom DTN claim containing the\
\ maximum yearly quota the customer purchased for calling DTN endpoints for the specific\
\ product. \
\ |\n | `iss` | String (URI) \
\ | The Security Token Service (STS) that issues and returns the token.\
\ If this value is not from `https://id.auth.dtn.com/`, the token should not be considered\
\ trusted. |\n | `sub` \
\ | String (URI) | The principle about\
\ which the token asserts information (the User ID or Client ID within the Identity Provider).\
\ A User ID will start with a prefix of `auth0\\|`, while the Client ID will end with the\
\ suffix `@clients`. |\n | `aud` | String \\| Array (Strings)\
\ (URI \\| [URI, …]) | Identifies the intended recipient(s) of the token – its audience.\
\ The token should be rejected if the audience does not contain values expected by the calling\
\ application. |\n | `iat` \
\ | Number (Timestamp) | “Issued At” indicates\
\ when the authentication for this token occurred. \
\ \
\ |\n | `exp` | Number (Timestamp)\
\ | The “expiration time” on or after which the JWT must not be\
\ accepted for processing. \
\ |\n | `azp`\
\ | String | The application/client\
\ ID of the client using the token. The application can cat as itself or on behalf of a\
\ user. \
\ |\n | `gty` | String (Space-delimited)\
\ | The grant type that was used to request the token – not an RFC 7519\
\ registered claim (Auth0-specific). \
\ |\n | `permissions`\
\ | Array (Strings) | The grant type that\
\ was used to request the token – not an RFC 7519 registered claim (Auth0-specific). \
\ \
\ |"
- name: clientCredentials
source: openapi/dtn-alerting-api-openapi.json
flows:
- flow: clientCredentials
tokenUrl: https://api.auth.dtn.com/v1/tokens/authorize
description: "# Using DAIS for M2M/API Auth\nYou have been given a Client ID and a Client\
\ Secret, which are used to request a DTN Access Token. DTN Access Tokens are required when\
\ making calls to each and every DTN API endpoint. The following information provides additional\
\ details on these tokens and how they are generated.\n## What is an Access Token and how\
\ is it different from an API Key?\nAn API Key is a random string of characters that an\
\ API uses to authorize whether or not a calling client has approved access to an endpoint.\
\ These keys are a non-standard approach to API authorization and are generally issued on\
\ a per-API basis.\n\nAn Access Token is also a string of characters but is a base-64 encoded\
\ JavaScript Object Notation Web Token, or JWT. JWTs are a widely accepted standard that\
\ use OAuth concepts and approaches. \n\nBoth API Keys and Access Tokens are used in an\
\ Authorization Request Header as a Bearer, meaning there is no difference in where you\
\ put this string of characters when you make calls to DTN APIs.\n## How to generate an\
\ Access Token?\nWhen requested, an Access Token is generated for your specific Client (ID/Secret)\
\ and for a specific API. The DTN Auth and Identity Service (DAIS) generates new Access\
\ Tokens for your client. The DAIS endpoint is `POST https://api.auth.dtn.com/v1/tokens/authorize`.\n\
\nThis endpoint takes two Header parameters:\n * `Content-Type: application/json`\n *\
\ `Accept: application/json`\n\nThis endpoint takes four parameters in the Request Body:\n\
\ * `grant_type`: this should always be client_credentials for generating machine-to-machine\
\ tokens.\n * `client_id`: this is the Client ID or Application ID using the token and\
\ is given to you by DTN's Identity Team. This ID will never change for your client/application.\n\
\ * `client_secret`: this is the Client Secret that is associated with the Application\
\ ID and is given to you by DTN's Identity Team. This key is subject to rotation for security\
\ purposes but always with the client's knowledge.\n * `audience`: this is the API for\
\ which this Access Token will be used. For the DTN Alerting API, you need to use the following\
\ audience: https://weather.api.dtn.com\n\nYou can use this CURL command template as a reference\
\ for obtaining an access token:\n ```\n curl --location --request POST 'https://api.auth.dtn.com/v1/tokens/authorize'\
\ \\\n--header 'Accept: application/json' \\\n--header 'Content-Type: application/json'\
\ \\\n--data-raw '{\n\"grant_type\": \"client_credentials\",\n\"client_id\": \"insert your\
\ client id here\",\n\"client_secret\": \"insert your client secret here\",\n\"audience\"\
: \"insert your audience here\"\n}' \n ```\n\n*This document, for demonstration purposes,\
\ supplies a client_id and client_secret in all code examples. This client/application is\
\ for a fictitious API and cannot be used in practice to gain unauthorized access to any\
\ other DTN API.*\nUpon generating a new Access Token, you should receive an HTTP Response\
\ from DAIS similar to this:\n ```\n {\n \"data\": {\n \"access_token\": \"\
eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6InpfX21pZW13NGhoTmdvQWQxR3N6ciJ9.eyJodHRwczovL2F1dGguZHRuLmNvbS9jdXN0b21lcklkIjoiMTIzNDU2Nzg5MERlbW8iLCJodHRwczovL2F1dGguZHRuLmNvbS9wcm9kdWN0Q29kZSI6IkRlbW9BcGlQIiwiaHR0cHM6Ly9hdXRoLmR0bi5jb20vcmVxdWVzdGVySXAiOiIxOC4yMTMuMTc0LjI3IiwiaHR0cHM6Ly9hdXRoLmR0bi5jb20vcnBzIjoiMTAwIiwiaHR0cHM6Ly9hdXRoLmR0bi5jb20vdGllciI6IkJhc2ljIiwiaHR0cHM6Ly9hdXRoLmR0bi5jb20vcXVvdGEiOiI5OTk5OTkiLCJpc3MiOiJodHRwczovL2lkLmF1dGguZHRuLmNvbS8iLCJzdWIiOiJuZnlPM0tpS1BSOE4wREtSNU
# --- truncated at 32 KB (478 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/dtn/refs/heads/main/scopes/dtn-scopes.yml