Authentication
This API uses authentication based on the OAuth 2.0 specification. Specifically, it utilizes the Client Credentials Grant (RFC 6749) to retrieve access tokens from the authorization server and send them as Bearer tokens to the API. The steps below detail how to retrieve an access token and send it with your API requests.
Retrieving a Token
To request a token, you must send a POST request to the access token endpoint located at https://auth.symed.com/identity/connect/token. You must send the following parameters in the request body as x-www-form-urlencoded form content.
| Name | Value | Description |
|---|---|---|
| grant_type | client_credentials |
Instructs the authorization server to handle this request using the Client Credentials grant. |
| scope | formsapi |
A space separated list of scopes. For access to the Sy.Med Forms Library, use "formsapi". |
| client_id | {CLIENT_ID} |
Your public client ID. |
| client_secret | {CLIENT_SECRET} |
Your private client secret. |
The following POST request is an example of a properly formed request for an access token, where the client ID is represented by {CLIENT_ID} and the client secret is represented by {CLIENT_SECRET}.
POST https://auth.symed.com/identity/connect/token HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Host: auth.symed.com
Content-Length: 96
grant_type=client_credentials&scope=formsapi&client_id={CLIENT_ID}&client_secret={CLIENT_SECRET}
On a successful request, the authorization server should return a token response in JSON format like the one below, where {TOKEN_VALUE} represents the value of the access token.
{
"access_token": {TOKEN_VALUE},
"expires_in": 3600,
"token_type": "Bearer"
}
Sending the Token
Once you have the token response, you can take the value of the access_token property and use it as a Bearer token in your API requests. To do so, you must add an Authorization header to your request with a value of the form "Bearer {ACCESS_TOKEN}". Below is a sample of a properly formed API request including the Authorization header.
GET https://forms.symed.com/api/forms/4cf5ed76-1785-446a-9dac-aef9f8f6fc06 HTTP/1.1 Accept: application/json Authorization: Bearer c6394ed8f1dc92a0fea52e36ab507d5b1 Host: forms.symed.com
If your token has expired, the API will send a 401 Unauthorized response with a WWW-Authenticate header with the value "Bearer". Simply make another request to the authorization server for a new access token and use it in your future API requests.