REP000 Gravitee Token

The gravitee token API is a web API designed according to REST principles.  

Authentication & Authorization

Authentication and authorization are managed using the OAuth Resource Owner Password Credentials Grant flow, which is part of the OAuth 2.0 Authorization Framework RFC (section 4.3).

How the OAuth Resource Owner Password Credentials Grant flow works

In short, the OAuth Resource Owner Password Credentials Grant flow works by requesting access-token from a token endpoint by passing account credentials in the request body. That access-token must be used in all subsequent API calls.

A successful response in the OAuth Resource Owner Password Credentials Grant flow looks like this:

{
   "access_token" : "<the key>", 
   "token_type" : "bearer",
   "expires_in" : 3599 
}

The access_token attribute holds the actual access-token, and the expires_in attribute shows how long the access-token is valid. When the access-token has expired, a new one must be requested.

The API client will require credentials related to two different accounts to access API:

• API account: client_id and client_secret
• SKF Enlight account: username and password

Credentials will be shared during the technical onboarding from SKF.

How to retrieve an access token

To retrieve an access token from the staging environment, construct a request like this:

Request header content-type: application/x-www-form-urlencoded

Request operation: POST https://am.dev.gravitee.skf.com:8092/skf-staging/oauth/token 

Request payload: 

grant_type=password&
username=<Enlight-username>&
password=<Enlight-password>

Add your client id and client secret separated by a colon and base64 encoded after the "Basic" keyword, to the Authorization header. Looking something like this:

An example of how to use a basic authentication can be found here: Basic header

To access an access-token valid in the production environment, change the request payload to include account information that is valid for the production environment, and change the request URL to https://am.gravitee.skf.com:8092/skf-prod/oauth/token.

Using the access token in API requests

The Authorization header must be included in all API calls. Here's an API call example that receives a list of vehicles from the TraX vehicle store:

Request header: Authorization: Bearer {your access token}

Request operation: GET https://staging.snaplogic.skf.com/trax/fleets/{fleetId}/vehicles

Response payload example:

{ "vehicles": [ 
   {
     "vehicleId": "740f410b-7f37-4dbc-9cc5-f7c160005dc7",
     "vin": "C25HA5R6LO5T2TE",
     "vehicleName": "SPACE TRUCK 8459",
     "brand": "Volvo",
     "model": "VHD 300 AF"
   }
 ]
}

Remember to change the fleetId in the URL to a fleet ID that has been onboarded to TraX by SKF.