Request an access token

curl --request POST \
  --url https://auth.sandbox.lerian.net/v1/login/oauth/access_token \
  --header 'Content-Type: application/json' \
  --data '
{
  "grantType": "password",
  "clientId": "00000000-0000-0000-0000-000000000000",
  "clientSecret": "00000000-0000-0000-0000-000000000000",
  "code": "4%2F0AbCd...idp",
  "codeVerifier": "dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk",
  "password": "password",
  "state": "kQ7f...opaque",
  "username": "johndoe"
}
'

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://auth.sandbox.lerian.net/v1/login/oauth/access_token"

	payload := strings.NewReader("{\n  \"grantType\": \"password\",\n  \"clientId\": \"00000000-0000-0000-0000-000000000000\",\n  \"clientSecret\": \"00000000-0000-0000-0000-000000000000\",\n  \"code\": \"4%2F0AbCd...idp\",\n  \"codeVerifier\": \"dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk\",\n  \"password\": \"password\",\n  \"state\": \"kQ7f...opaque\",\n  \"username\": \"johndoe\"\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

const options = {
  method: 'POST',
  headers: {'Content-Type': 'application/json'},
  body: JSON.stringify({
    grantType: 'password',
    clientId: '00000000-0000-0000-0000-000000000000',
    clientSecret: '00000000-0000-0000-0000-000000000000',
    code: '4%2F0AbCd...idp',
    codeVerifier: 'dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk',
    password: 'password',
    state: 'kQ7f...opaque',
    username: 'johndoe'
  })
};

fetch('https://auth.sandbox.lerian.net/v1/login/oauth/access_token', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

import requests

url = "https://auth.sandbox.lerian.net/v1/login/oauth/access_token"

payload = {
    "grantType": "password",
    "clientId": "00000000-0000-0000-0000-000000000000",
    "clientSecret": "00000000-0000-0000-0000-000000000000",
    "code": "4%2F0AbCd...idp",
    "codeVerifier": "dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk",
    "password": "password",
    "state": "kQ7f...opaque",
    "username": "johndoe"
}
headers = {"Content-Type": "application/json"}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

{
  "accessToken": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ",
  "expiresIn": 3600,
  "refreshToken": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ",
  "tokenType": "Bearer",
  "idToken": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ",
  "scope": "openid profile email"
}

{
  "code": "AUT-0009",
  "fields": {},
  "message": "<string>",
  "title": "Bad Request"
}

{
  "code": "AUT-0009",
  "fields": {},
  "message": "<string>",
  "title": "Bad Request"
}

{
  "code": "AUT-0009",
  "fields": {},
  "message": "<string>",
  "title": "Bad Request"
}

{
  "code": "AUT-0009",
  "fields": {},
  "message": "<string>",
  "title": "Bad Request"
}

{
  "code": "AUT-0009",
  "fields": {},
  "message": "<string>",
  "title": "Bad Request"
}

{
  "code": "AUT-0009",
  "fields": {},
  "message": "<string>",
  "title": "Bad Request"
}

Request an access token

Issues an OAuth2 access token. No Bearer token is needed; the grant itself is the credential.

Two request formats are accepted, chosen by Content-Type, and each has its own response shape:

application/json with camelCase members (grantType, clientId, clientSecret, username, password, code, state, codeVerifier) answers with the camelCase token (accessToken, tokenType, expiresIn, …).
application/x-www-form-urlencoded with the standard OAuth2 members (grant_type, client_id, client_secret, username, password, code) answers with the standard snake_case token (access_token, token_type, expires_in, …). Client credentials may instead be sent as HTTP Basic authentication, which then takes precedence over client_id/client_secret in the form.

grantType is one of password, client_credentials or sso_code. password requires username and password; client_credentials requires clientId and clientSecret; sso_code requires code, state and codeVerifier (the PKCE verifier of the code_challenge sent to GET /v1/sso/start), and is a JSON-only grant.

When the person signing in has MFA enabled, a password or sso_code grant does not issue a token: it answers 200 with mfaRequired=true and an mfaToken, which is then sent to POST /v1/login/mfa/verify to obtain the token.

Errors use the envelope, plus fields on body validation errors. 400: Content-Type missing or not one of the two formats, malformed form or Basic credentials (AUT-0009), a grant missing the members it needs (AUT-0014), an invalid or expired SSO code (AUT-0027). 401: wrong username or password (AUT-1002), wrong client credentials (AUT-1004), password grant for a person created through SSO with no password (AUT-1006), suspended or expired partner (AUT-1009, AUT-1010). 403: caller IP outside the IP allowlist (AUT-0021), person not allowed to sign in (AUT-1008). 429: account temporarily locked after repeated failures (AUT-1007). 503 AUT-0028: the sign-in needs a second factor and this server has no MFA signing secret configured.

POST

oauth

access_token

Request an access token

curl --request POST \
  --url https://auth.sandbox.lerian.net/v1/login/oauth/access_token \
  --header 'Content-Type: application/json' \
  --data '
{
  "grantType": "password",
  "clientId": "00000000-0000-0000-0000-000000000000",
  "clientSecret": "00000000-0000-0000-0000-000000000000",
  "code": "4%2F0AbCd...idp",
  "codeVerifier": "dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk",
  "password": "password",
  "state": "kQ7f...opaque",
  "username": "johndoe"
}
'

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://auth.sandbox.lerian.net/v1/login/oauth/access_token"

	payload := strings.NewReader("{\n  \"grantType\": \"password\",\n  \"clientId\": \"00000000-0000-0000-0000-000000000000\",\n  \"clientSecret\": \"00000000-0000-0000-0000-000000000000\",\n  \"code\": \"4%2F0AbCd...idp\",\n  \"codeVerifier\": \"dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk\",\n  \"password\": \"password\",\n  \"state\": \"kQ7f...opaque\",\n  \"username\": \"johndoe\"\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

const options = {
  method: 'POST',
  headers: {'Content-Type': 'application/json'},
  body: JSON.stringify({
    grantType: 'password',
    clientId: '00000000-0000-0000-0000-000000000000',
    clientSecret: '00000000-0000-0000-0000-000000000000',
    code: '4%2F0AbCd...idp',
    codeVerifier: 'dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk',
    password: 'password',
    state: 'kQ7f...opaque',
    username: 'johndoe'
  })
};

fetch('https://auth.sandbox.lerian.net/v1/login/oauth/access_token', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

import requests

url = "https://auth.sandbox.lerian.net/v1/login/oauth/access_token"

payload = {
    "grantType": "password",
    "clientId": "00000000-0000-0000-0000-000000000000",
    "clientSecret": "00000000-0000-0000-0000-000000000000",
    "code": "4%2F0AbCd...idp",
    "codeVerifier": "dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk",
    "password": "password",
    "state": "kQ7f...opaque",
    "username": "johndoe"
}
headers = {"Content-Type": "application/json"}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

{
  "accessToken": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ",
  "expiresIn": 3600,
  "refreshToken": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ",
  "tokenType": "Bearer",
  "idToken": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ",
  "scope": "openid profile email"
}

{
  "code": "AUT-0009",
  "fields": {},
  "message": "<string>",
  "title": "Bad Request"
}

{
  "code": "AUT-0009",
  "fields": {},
  "message": "<string>",
  "title": "Bad Request"
}

{
  "code": "AUT-0009",
  "fields": {},
  "message": "<string>",
  "title": "Bad Request"
}

{
  "code": "AUT-0009",
  "fields": {},
  "message": "<string>",
  "title": "Bad Request"
}

{
  "code": "AUT-0009",
  "fields": {},
  "message": "<string>",
  "title": "Bad Request"
}

{
  "code": "AUT-0009",
  "fields": {},
  "message": "<string>",
  "title": "Bad Request"
}

Headers

Authorization

string

Optional HTTP Basic client authentication (Basic base64(client_id:client_secret)), read on form requests only. When present it takes precedence over client_id/client_secret in the form body.

Body

grantType

enum<string>

required

Available options:

password,

client_credentials,

sso_code

Example:

"password"

clientId

string

Example:

"00000000-0000-0000-0000-000000000000"

clientSecret

string

Example:

"00000000-0000-0000-0000-000000000000"

code

string

Example:

"4%2F0AbCd...idp"

codeVerifier

string

Example:

"dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk"

password

string

Example:

"password"

state

string

Example:

"kQ7f...opaque"

username

string

Example:

"johndoe"

Response

Option 1
Option 2
Option 3

accessToken

string

required

The issued OAuth2 access token (JWT).

Example:

"eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ"

expiresIn

integer<int64>

required

Access token lifetime in seconds.

Example:

3600

refreshToken

string

required

The refresh token to obtain a new access token.

Example:

"eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ"

tokenType

string

required

The token type; always "Bearer".

Example:

"Bearer"

idToken

string

The OIDC ID token (JWT).

Example:

"eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ"

scope

string

Space-delimited scopes granted to the token.

Example:

"openid profile email"

Overview

Authentication

Single sign-on

Authorization

User information

Login MFA

Identity overview

Groups

Applications

Partners

Users

Account MFA

Identity providers

Application providers

Permissions

Roles

Security policies

Plugin declarations

Error handling

Request an access token

Headers

Body

Response