# Everest Card — generated from the portal's compiled model.
# Do not edit: re-download rather than patch, or this drifts from the platform.
#
# Set @accessToken before sending anything. The token is a client_credentials
# grant against the OAuth2 service — you supply the id and the secret, and the
# portal never stores either.

# OAuth2 Security Token Service API — v8.3.5.22, 5 operations.

@baseUrl = https://devcard.sim-ant.com/SandBox/oAuth2
@accessToken =

### authorize
# OAuth2 authorization endpoint.
POST {{baseUrl}}/sts/api/authorize
Content-Type: application/json
Authorization: Bearer {{accessToken}}

{}

### token
# Exchanges valid credentials or artifacts for OAuth tokens according to the requested grant_type. Depending on the flow, the request can include user credentials, an authorization code, a refresh_token, or an assertion, alongside client_id / client_secret (and optionally code_verifier for PKCE). The service validates the client, verifies the grant-specific inputs, and enforces scope rules before issuing tokens. On success, it returns an access_token, token_type, expires_in, and optionally a refresh_token to enable session continuation without re-authentication.
POST {{baseUrl}}/sts/api/token
Content-Type: application/json
Authorization: Bearer {{accessToken}}

{}

### revoke
# Revokes an access or refresh token so it can no longer be used. RFC 7009; the response carries no body.
POST {{baseUrl}}/sts/api/revoke
Content-Type: application/json
Authorization: Bearer {{accessToken}}

{}

### introspect
# Checks whether an access token is still active and reads back its scope, subject, client, issue and expiry times. RFC 7662.
POST {{baseUrl}}/sts/api/introspect
Content-Type: application/json
Authorization: Bearer {{accessToken}}

{}

### healthCheck
# Performs a lightweight health probe to confirm the STS component is running and able to respond to requests. This endpoint is intended for monitoring systems, load balancers, and deployment readiness checks. The response includes a simple result indicator and a server timestamp to help validate connectivity and clock sanity. Use this operation to quickly distinguish platform/network issues from functional authorization/token errors.
POST {{baseUrl}}/sts/api/healthCheck
Content-Type: application/json
Authorization: Bearer {{accessToken}}

{}