Cionic Authentication

generated: '2026-08-09'
method: searched
source: https://github.com/cionicwear/cionic-data/blob/main/cionic/api.py
docs: https://github.com/cionicwear/cionic-data/blob/main/scripts/README.md
note: >-
  CIONIC publishes no OpenAPI, so no securityScheme could be derived. This profile is
  read from the first-party open-source client (cionic/api.py, MIT) and confirmed by
  anonymous probes of the live endpoints. Nothing here required credentials.
summary:
  types:
  - apiKey
  - http
  - oauth2
  api_key_in:
  - header
  oauth2_flows:
  - authorizationCode
schemes:
- name: x-cionic-user
  type: apiKey
  in: header
  parameter_name: x-cionic-user
  description: >-
    The platform access token sent on every request to the /a, /c and /w services.
    Researchers obtain it as token.json from the profile menu of the web portal at
    https://cionic.com/a ("Download Token"); the client reads the "token" key from
    that file.
  sources:
  - https://github.com/cionicwear/cionic-data/blob/main/cionic/api.py
  - https://github.com/cionicwear/cionic-data/blob/main/scripts/README.md
- name: OAuthBearer
  type: http
  scheme: bearer
  description: >-
    An OAuth access token supplied as Authorization: Bearer and exchanged at
    GET https://{domain}/oauth/user, whose response carries the platform token in
    the "atok" field. The client reads it from the CIONIC_ACCESS_TOKEN environment
    variable when no token file is given.
  token_exchange_endpoint: https://cionic.com/oauth/user
  environment_variable: CIONIC_ACCESS_TOKEN
  sources:
  - https://github.com/cionicwear/cionic-data/blob/main/cionic/api.py
- name: OAuth2
  type: oauth2
  flows:
  - flow: authorizationCode
    authorizationUrl: https://cionic.com/oauth/authorize
    tokenUrl: https://cionic.com/oauth/token
    scopes: {}
    note: >-
      No scope reference is published. GET /oauth/authorize 302s to the portal login
      at /a?redir=%2Foauth%2Fauthorize%3F; GET /oauth/token returns 405, so the token
      endpoint is POST-only.
login:
  style: email-magic-link
  url: https://cionic.com/a
  description: >-
    The researcher and clinician portal takes an email address and mails a sign-in
    link; the portal then exposes a downloadable token and, for mobile, a "Gateway"
    token authorisation flow through the CIONIC app.
authorization_model:
  scope: per-organization roles
  roles:
  - name: analyst
    id: 1
  - name: collector
    id: 2
  - name: admin
    id: 3
  grant_endpoint: POST /a/v{version}/{org}/accounts/{xid}/roles
  revoke_endpoint: DELETE /a/v{version}/{org}/accounts/{xid}/roles/{role_id}
  note: Role administration requires the org admin role.
x-evidence:
- url: https://cionic.com/a/v2.0/accounts/@me
  http_status: 401
  content_type: application/json
  body: '{"error":"Unauthorized"}'
  fetched: '2026-08-09'
- url: https://cionic.com/oauth/authorize
  http_status: 302
  location: /a?redir=%2Foauth%2Fauthorize%3F
  fetched: '2026-08-09'
- url: https://cionic.com/oauth/token
  http_status: 405
  note: GET rejected; token endpoint is POST-only
  fetched: '2026-08-09'
- url: https://raw.githubusercontent.com/cionicwear/cionic-data/main/cionic/api.py
  http_status: 200
  fetched: '2026-08-09'