Authentication
Get a bearer token. Every other call on this portal needs one first.
Operations
oauth2-security-token-service
/sts/api/authorize
OAuth2 authorization endpoint.
POST/sts/api/token
Exchanges valid credentials or artifacts for OAuth tokens according to the requested grant_type. Depending on the flow, the request can include user credentials, an authorization code, a refresh_token, or an assertion, alongside client_id / client_secret (and optionally code_verifier for PKCE). The service validates the client, verifies the grant-specific inputs, and enforces scope rules before issuing tokens. On success, it returns an access_token, token_type, expires_in, and optionally a refresh_token to enable session continuation without re-authentication.
POST/sts/api/revoke
Revokes an access or refresh token so it can no longer be used. RFC 7009; the response carries no body.
POST/sts/api/introspect
Checks whether an access token is still active and reads back its scope, subject, client, issue and expiry times. RFC 7662.