Three-Legged Context
POST
gettoken
Exchange an authorization code extracted from a GET authorize callback for a three-legged access token. This API will only be used when the “Authorization Code” grant type is being adopted.
Resource Information
| Method and URI | POST https://developer.api.autodesk.com/authentication/v1/gettoken |
| Data Format | Form encoding (request); JSON (response) |
| Rate Limit | 500 calls per minute |
Request
Headers
| Content-Type* string | Must be application/x-www-form-urlencoded |
* Required
Request
Body Structure
The request body is a URL-encoded string of ampersand-concatenated, name-value pairs of the following parameters:
| client_id* string | Client ID of the app |
| client_secret* string | Client secret of the app |
| grant_type* string | Must be authorization_code |
| code* string | The authorization code captured from the code query parameter
when the
GET authorize
redirected back to the callback URL |
| redirect_uri* string | Must match the redirect_uri parameter used in
GET authorize |
* Required
Response
HTTP Status Code Summary
| 200 OK | Successful request; access token returned. |
| 400 Bad Request | One or more parameters are invalid. Examine the response payload body for details. |
| 401 Unauthorized | The client_id and client_secret combination is not valid. |
| 403 Forbidden | The client_id is not authorized to access this endpoint. |
| 415 Unsupported Media Type | The Content-Type header is missing or specifies a value other than
application/x-www-form-urlencoded. |
| 429 Too Many Requests | Rate limit exceeded; wait some time before retrying. |
| 500 Internal Server Error | Generic internal server error. |
Response
Body Structure (200)
The response body for a successful call is a flat JSON object with the following attributes:
| token_type string | Will always be Bearer |
| expires_in int | Access token expiration time (in seconds) |
| refresh_token string | The refresh token |
| access_token string | The access token |
Example
Successful exchange of authorization code for access token (200)
Request
curl -v 'https://developer.api.autodesk.com/authentication/v1/gettoken' \
-X 'POST' \
-H 'Content-Type: application/x-www-form-urlencoded' \
-d 'client_id=obQDn8P0GanGFQha4ngKKVWcxwyvFAGE' \
-d 'client_secret=eUruM8HRyc7BAQ1e' \
-d 'grant_type=authorization_code' \
-d 'code=wroM1vFA4E-Aj241-quh_LVjm7UldawnNgYEHQ8I' \
-d 'redirect_uri=http://sampleapp.com/oauth/callback'
Show More
Note that line breaks have been added to the cURL command above for ease of reading, but should be removed before executing the command in a terminal.
Response
HTTP/1.1 200 OK
Cache-Control: no-cache, no-store, no-store
Content-Type: application/json;charset=UTF-8
Date: Sat, 04 Jun 2016 18:59:25 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
max-age: Thu, 01 Jan 1970 00:00:00 GMT
Pragma: no-cache
Server: Apigee Router
Set-Cookie: PF=ix2tNCKRRb9WwM6dO78Eic;Path=/;Secure;HttpOnly
Set-Cookie: bbbbbbbbbbbbbbb=KINDJALIIFLMNIHHAHLBPHPKNNFLHCIPDCKLJALMEDMDNIALGOKPFOLFNOOAMPMFBDMCGBOHPPEMLJGGECNMBMGBNKFOGINKCPLEAEJBFNDJEPHGCJPAJLKPNMLDEJEN; HttpOnly; secure
X-Frame-Options: SAMEORIGIN
Content-Length: 89
Connection: keep-alive
{
"token_type": "Bearer",
"expires_in": 1799,
"refresh_token": "i0kBWTHzI0JVKWTOoFn6cvPk32SZcs5CUtwic3nduc",
"access_token": "eyJhbGciOiJIUzI1NiIsImtpZCI6Imp3dF9zeW1tZXRyaWNfa2V5X2RldiJ9.eyJ1c2VyaWQiOiI1TUhETFlQM1hTRksiLCJleHAiOjE0ODc1NzM0MjEsInNjb3BlIjpbXSwiY2xpZW50X2lkIjoiY1kxanJta0F4T0labW5zbDlYWDdKblVEbVRFRExjRngiLCJncmFudF9pZCI6InZPSk9BcElkZVQyekdkWlViMWZvb0psSmVMSHl0NldyIiwiYXVkIjoiaHR0cHM6Ly9hdXRvZGVzay5jb20vYXVkL2p3dGV4cDMwIiwianRpIjoiY0Q5UmNUM3ZZRG5tODdud2praTN2U2JOQlZPMTl1emxjc28wZWlRMjdZUXExcXpaaUlvZzVyQ3NDV0xqVXRjUSJ9.j0HbmjfujNqBUaOzaAFvDHVUpoiCZmeXVTZrBjT1la0"
}
Show More
