{
 "info": {
  "_postman_id": "everest-oauth2-8.3.5.22",
  "name": "Everest oauth2 8.3.5.22",
  "schema": "https://schema.getpostman.com/json/collection/v2.1.0/collection.json"
 },
 "item": [
  {
   "name": "authorize",
   "request": {
    "method": "POST",
    "header": [
     {
      "key": "Content-Type",
      "value": "application/json"
     },
     {
      "key": "Authorization",
      "value": "Bearer {{accessToken}}"
     }
    ],
    "url": {
     "raw": "{{baseUrl}}/sts/api/authorize"
    },
    "description": "OAuth2 authorization endpoint."
   }
  },
  {
   "name": "token",
   "request": {
    "method": "POST",
    "header": [
     {
      "key": "Content-Type",
      "value": "application/json"
     },
     {
      "key": "Authorization",
      "value": "Bearer {{accessToken}}"
     }
    ],
    "url": {
     "raw": "{{baseUrl}}/sts/api/token"
    },
    "description": "Exchanges valid credentials or artifacts for OAuth tokens according to the requested grant_type. Depending on the flow, the request can include user credentials, an authorization code, a refresh_token, or an assertion, alongside client_id / client_secret (and optionally code_verifier for PKCE). The service validates the client, verifies the grant-specific inputs, and enforces scope rules before issuing tokens. On success, it returns an access_token, token_type, expires_in, and optionally a refresh_token to enable session continuation without re-authentication."
   }
  },
  {
   "name": "revoke",
   "request": {
    "method": "POST",
    "header": [
     {
      "key": "Content-Type",
      "value": "application/json"
     },
     {
      "key": "Authorization",
      "value": "Bearer {{accessToken}}"
     }
    ],
    "url": {
     "raw": "{{baseUrl}}/sts/api/revoke"
    },
    "description": "Revokes an access or refresh token so it can no longer be used. RFC 7009; the response carries no body."
   }
  },
  {
   "name": "introspect",
   "request": {
    "method": "POST",
    "header": [
     {
      "key": "Content-Type",
      "value": "application/json"
     },
     {
      "key": "Authorization",
      "value": "Bearer {{accessToken}}"
     }
    ],
    "url": {
     "raw": "{{baseUrl}}/sts/api/introspect"
    },
    "description": "Checks whether an access token is still active and reads back its scope, subject, client, issue and expiry times. RFC 7662."
   }
  },
  {
   "name": "healthCheck",
   "request": {
    "method": "POST",
    "header": [
     {
      "key": "Content-Type",
      "value": "application/json"
     },
     {
      "key": "Authorization",
      "value": "Bearer {{accessToken}}"
     }
    ],
    "url": {
     "raw": "{{baseUrl}}/sts/api/healthCheck"
    },
    "description": "Performs a lightweight health probe to confirm the STS component is running and able to respond to requests. This endpoint is intended for monitoring systems, load balancers, and deployment readiness checks. The response includes a simple result indicator and a server timestamp to help validate connectivity and clock sanity. Use this operation to quickly distinguish platform/network issues from functional authorization/token errors."
   }
  }
 ],
 "variable": [
  {
   "key": "baseUrl",
   "value": "https://devcard.sim-ant.com/SandBox/OAuth2"
  },
  {
   "key": "accessToken",
   "value": ""
  }
 ]
}