Authentication
Get a bearer token. Every other call on this portal needs one first.
authorize
Initiates an OAuth/OpenAuth authorization request and returns the data required to continue the authorization flow. This operation validates the incoming authorization context (e.g., client identity, requested grant/response type, redirect URI, and scope) and, when applicable, issues an authorization code tied to the request. It also supports additional flow parameters such as state for CSRF protection and code_challange / PKCE-related inputs to harden public-client scenarios. On success, the response provides the redirect_uri, code, and state values needed by the client to complete the next step of the flow.
Headers
evrst-ptrnidCorrelation id for this request. Echo it in your own logs to trace the call through the platform.
authorize › Request Body
response_typeAn OAuth2 parameter, defined by RFC 6749 rather than by a column here.
grant_typeAn OAuth2 parameter, defined by RFC 6749 rather than by a column here.
client_idAn OAuth2 parameter. Its form is the authorisation server's and is defined by RFC 6749 rather than by a column here.
client_secretAn OAuth2 parameter. Its form is the authorisation server's and is defined by RFC 6749 rather than by a column here.
redirect_uriAn OAuth2 parameter, defined by RFC 6749 rather than by a column here.
scopeAn OAuth2 parameter, defined by RFC 6749 rather than by a column here.
stateAn OAuth2 parameter the client chooses and the server echoes; RFC 6749 sets no length and neither does any column here.
code_challengeCode Challenge
A PKCE parameter, defined by RFC 7636 rather than by a column here.
code_challenge_methodCode Challenge Method
A PKCE parameter, defined by RFC 7636 rather than by a column here.
action_idChosen by the caller and echoed back; no column behind this API stores it.
authorize › Responses
Success
redirect_uricodestatetoken
Exchanges valid credentials or artifacts for OAuth tokens according to the requested grant_type. Depending on the flow, the request can include user credentials, an authorization code, a refresh_token, or an assertion, alongside client_id / client_secret (and optionally code_verifier for PKCE). The service validates the client, verifies the grant-specific inputs, and enforces scope rules before issuing tokens. On success, it returns an access_token, token_type, expires_in, and optionally a refresh_token to enable session continuation without re-authentication.
Part of:
-
Journey 01 · Launching a new card product — step 1, Get an access token
-
Journey 01 · Launching a new card product — step 1, Get an access token
-
Journey 01 · Launching a new card product — step 1, Get an access token
Headers
evrst-ptrnidCorrelation id for this request. Echo it in your own logs to trace the call through the platform.
token › Request Body
grant_typeAn OAuth2 parameter, defined by RFC 6749 rather than by a column here.
scopeAn OAuth2 parameter, defined by RFC 6749 rather than by a column here.
usernameUser Id
An OAuth2 parameter, defined by RFC 6749 rather than by a column here.
passwordThe resource owner's password, for the password grant only. Defined by RFC 6749 rather than by this platform, and ignored by every other grant type.
codeAn OAuth2 authorisation code. Its form is the authorisation server's rather than a column's.
redirect_uriAn OAuth2 parameter, defined by RFC 6749 rather than by a column here.
refresh_tokenAn OAuth2 token, whose form is the authorisation server's rather than a column's.
assertionAn OAuth2 assertion, whose form is the issuing party's rather than a column's.
client_idAn OAuth2 parameter. Its form is the authorisation server's and is defined by RFC 6749 rather than by a column here.
client_secretAn OAuth2 parameter. Its form is the authorisation server's and is defined by RFC 6749 rather than by a column here.
code_verifierA PKCE parameter, defined by RFC 7636 rather than by a column here.
attestation_tokenIssued and checked by the attestation service; its form is that service's rather than a column's.
token › Responses
Success
expires_inaccess_tokentoken_typerefresh_tokenscoperevoke
Revoke Token
Headers
evrst-ptrnidCorrelation id for this request. Echo it in your own logs to trace the call through the platform.
revoke › Request Body
tokenToken
An OAuth2 token, whose form is the authorisation server's rather than a column's.
token_type_hintToken Type Hint
An OAuth2 parameter, defined by RFC 7009 rather than by a column here.
client_idClient Id
An OAuth2 parameter. Its form is the authorisation server's and is defined by RFC 6749 rather than by a column here.
client_secretClient Secret
An OAuth2 parameter. Its form is the authorisation server's and is defined by RFC 6749 rather than by a column here.
revoke › Responses
Success
introspect
Introspect Token
Headers
evrst-ptrnidCorrelation id for this request. Echo it in your own logs to trace the call through the platform.
introspect › Request Body
tokenToken
An OAuth2 token, whose form is the authorisation server's rather than a column's.
token_type_hintToken Type Hint
An OAuth2 parameter, defined by RFC 7009 rather than by a column here.
client_idClient Id
An OAuth2 parameter. Its form is the authorisation server's and is defined by RFC 6749 rather than by a column here.
client_secretClient Secret
An OAuth2 parameter. Its form is the authorisation server's and is defined by RFC 6749 rather than by a column here.
introspect › Responses
Success
activescopeclient_idusernametoken_typeexpiatjtiiss