Ackogeneralinsurance Authentication

generated: '2026-09-06'
method: searched
source: https://www.acko.com/enterprise/documentation/enterprise.html
spec_source: openapi/_original/ackogeneralinsurance-enterprise-openapi.json
note: >-
  The published OpenAPI declares NO components.securitySchemes. The auth model below is read from the
  Authentication tag description, the tokenGeneration operation, and the Authorization header
  parameter that every one of the 30 operations marks required. Confirmed live: an unauthenticated
  GET https://www.acko.com/external/partnership/policy returns 401
  {"error":"Invalid token, error: Not a bearer token"}.
summary:
  primary_model: oauth2-client-credentials
  token_endpoint: https://www.acko.com/realms/partnership/protocol/openid-connect/token
  token_endpoint_operation_id: tokenGeneration
  identity_provider: Keycloak (realm "partnership", RESTEasy OIDC token endpoint observed live)
  scheme_count_declared_in_spec: 0
  operations_requiring_auth: 30
  onboarding: >-
    Client credentials are issued by ACKO when a partner product is onboarded; the spec states the
    credential material "will be shared over mail when the product is onboarded". There is no
    self-serve signup for the partnership API.
schemes:
- id: partnership-oauth2-client-credentials
  type: oauth2
  flow: clientCredentials
  token_url: https://www.acko.com/realms/partnership/protocol/openid-connect/token
  parameters:
  - name: grant_type
    in: query
    required: true
    description: Type of grant being requested
  - name: client_id
    in: query
    required: true
    description: The unique identifier for the partner
  - name: client_secret
    in: query
    required: true
    description: The secret key associated with the partner's client_id
  response_fields:
  - accessToken
  - expiresIn
  - refreshExpiresIn
  - tokenType
  - notBeforePolicy
  - scope
  scopes_enumerated: false
  scopes_note: >-
    The token response carries a `scope` string but the documentation enumerates no scope values, so
    no scopes/ artifact is derivable. Requesting an OAuth scope reference is a provider follow-up.
  evidence: openapi/_original/ackogeneralinsurance-enterprise-openapi.json#/paths/~1realms~1partnership~1protocol~1openid-connect~1token/post
- id: partnership-authorization-header
  type: http
  in: header
  name: Authorization
  required_on_operations: 30
  description_verbatim: >-
    "username={partner} algorithm={algo} created_on={time} secret={secret}   This will be shared over
    mail when the product is onboarded"
  note: >-
    On the token endpoint the Authorization header carries the partner signature string quoted above.
    On the 29 business operations the header is documented only as a required Authorization header;
    the live gateway rejects a non-bearer value with 401 "Not a bearer token", so business calls
    carry the OAuth 2.0 bearer access token from tokenGeneration.
  evidence: https://www.acko.com/external/partnership/policy
errors:
- status: 401
  schema: InvalidClientCredentials
  example:
    error: unauthorized_client
    error_description: Invalid client or Invalid client credentials
gaps:
- securitySchemes are absent from the published OpenAPI, so no machine-readable auth binding exists.
- No scope reference is published.
- No token TTL / refresh policy is documented beyond the expiresIn and refreshExpiresIn response fields.