Skip to main content

Authentication & Authorization

This page explains how authentication, authorization, and scopes work across all OpenAPI endpoints.

Authentication Flows​

Our APIs support multiple OAuth2 flows:

1. Machine-to-Machine​

Each client account gives access to the APIs of a single SECUTIX institution.

  • Flow: client_credentials
  • Use case: backend systems (e.g., partners integrating serverside)
  • How it works:
    • Exchange your client_id and client_secret for an access token.
    • Token contains scopes granted to your application.

Example Request:

curl -X POST https://INSTITUTION.api.secutix.com/auth/token \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "grant_type=client_credentials" \
  -d "client_id=YOUR_CLIENT_ID" \
  -d "client_secret=YOUR_CLIENT_SECRET"

Scopes​

Scopes define which Machine-to-Machine API endpoints you are allowed to use.

Scopes are decided during client registration. Then, all the access tokens you generate will contain these scopes. Scopes will always be given following the least-privilege principle. Communicate your needs when you request your account to the new APIs, and we can always modify your scopes later if your use cases evolve.

SECUTIX APIs use explicit scope matching (no longest prefix matching is performed).

Example Scopes​
  • domain:read → read access to general resources in a domain
  • domain:write → write access to general resources in a domain
  • domain.sensitive:read → read access to sensitive sub-resources. If a client only has the domain:read scope, it does not have read access to these resources
  • domain.sensitive:write → write access to sensitive sub-resources. If a client only has the domain:write scope, it does not have write access to these resources

2. [UPCOMING] Browser / User Context​

  • Flow: authorization_code with PKCE
  • Use case: front-end applications where an end-user is logged in
  • How it works:
    • User signs in through our OneFanBase login.
    • Your app receives an access token tied to the user's identity.
    • Claims in the token (e.g., tenant, role) restrict what data the user can access.

3. [UPCOMING] Public Access​

  • Flow: none (no token)
  • Use case: accessing resources that are publicly available
  • How it works:
    • You may call certain endpoints with no Authorization header.
    • Response includes only limited public data.
    • Sensitive information requires an authenticated token.
    • An API key is needed for metering and usage tracking.

Make Authenticated Requests​

Once you have generated your token, you can call our apis.

The same endpoints are used regardless of the authentication flow. It is the token's client and scopes which determine what data you can access.

Here is an example with the Machine-to-Machine flow:

curl -X GET https://INSTITUTION.api.secutix.com/s360/v3/catalog \
  -H "Authorization: Bearer YOUR_ACCESS_TOKEN" \
  -H "Content-Type: application/json"