Two-Legged Context
POST
authenticate
Get a two-legged access token by providing your app’s client ID and secret.
Resource Information
| Method and URI | POST https://developer.api.autodesk.com/authentication/v1/authenticate |
| Data Format | Form encoding (request); JSON (response) |
| Rate Limit | 500 calls per minute |
Request
Headers
| Content-Type* string | Must be application/x-www-form-urlencoded |
* Required
Request
Body Structure
The request body is a URL-encoded string of ampersand-concatenated, name-value pairs of the following parameters:
| client_id* string | Client ID of the app |
| client_secret* string | Client secret of the app |
| grant_type* string | Must be client_credentials |
| scope string | Space-separated list of required scopes
Note: A URL-encoded space is
%20.* See the Scopes
page for more information on when scopes are required.
|
* Required
Response
HTTP Status Code Summary
| 200 OK | Successful request; access token returned. |
| 400 Bad Request | One or more parameters are invalid. Examine the response payload body for details. |
| 401 Unauthorized | The client_id and client_secret combination is not valid. |
| 403 Forbidden | The client_id is not authorized to access this endpoint. |
| 415 Unsupported Media Type | The Content-Type header is missing or specifies a value other than
application/x-www-form-urlencoded. |
| 429 Too Many Requests | Rate limit exceeded; wait some time before retrying. |
| 500 Internal Server Error | Generic internal server error. |
Response
Body Structure (200)
The response body for a successful call is a flat JSON object with the following attributes:
| token_type string | Will always be Bearer |
| expires_in int | Access token expiration time (in seconds) |
| access_token string | The access token |
Example
Successful access token acquisition (200)
Request
curl -v 'https://developer.api.autodesk.com/authentication/v1/authenticate'
-X 'POST'
-H 'Content-Type: application/x-www-form-urlencoded'
-d '
client_id=obQDn8P0GanGFQha4ngKKVWcxwyvFAGE&
client_secret=eUruM8HRyc7BAQ1e&
grant_type=client_credentials&
scope=data:read
'
Show More
Note that line breaks have been added to the cURL command above for ease of reading. Make sure to remove them before executing any code in your terminal.
Response
HTTP/1.1 200 OK
Cache-Control: no-cache, no-store, no-store
Content-Type: application/json;charset=UTF-8
Date: Mon, 20 Feb 2017 04:46:41 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
max-age: Thu, 01 Jan 1970 00:00:00 GMT
Pragma: no-cache
Server: Apigee Router
Set-Cookie: PF=2xeh6LTdKKqibsTu9HlyM5;Path=/;Secure;HttpOnly
X-Frame-Options: SAMEORIGIN
Content-Length: 436
Connection: keep-alive
{
"token_type": "Bearer",
"expires_in": 1799,
"access_token": "eyJhbGciOiJIUzI1NiIsImtpZCI6Imp3dF9zeW1tZXRyaWNfa2V5X2RldiJ9.eyJjbGllbnRfaWQiOiJjWTFqcm1rQXhPSVptbnNsOVhYN0puVURtVEVETGNGeCIsImV4cCI6MTQ4NzU2NzgwMSwic2NvcGUiOlsiZGF0YTpyZWFkIl0sImF1ZCI6Imh0dHBzOi8vYXV0b2Rlc2suY29tL2F1ZC9qd3RleHAzMCIsImp0aSI6InJZcEZZTURyemtMOWZ1ZFdKSVVlVkxucGNWT29BTDg0dFpKbXlmZ29ORW1MakF0YVVtWktRWU1lYUR2UGlnNGsifQ.uzNexXCeu4efGPKGGhHdKxoJDXHAzLb28B2nSjrq_ys"
}
Show More
