Authentication

all updates api requests require a short lived access token the validity periods for the long lived and short lived tokens are configurable to suit your security requirements the updates api uses a two step authentication flow create an integration consumer in the jomablue portal and generate a long lived token exchange that long lived token for a short lived access token, then send the short lived token on your updates api requests you can create multiple consumers, each with a limited scope, and multiple access tokens per consumer for example, one consumer might be your crm or marketing system, while another consumer (such as an onsite activation or a third party) is granted a narrower scope of data access token rotation is supported endpoint post https //your instance jomablue com/integration/api/auth send your long lived token as the bearer token the response returns a short lived access token in the data field headers include these headers on all requests authorization bearer \<token> accept application/json when sending a json body (such as the auth request), also include content type application/json send an appropriate user agent so jomablue can identify requests originating from your systems examples step 1 request a short lived token send your long lived token in the authorization header example request curl request post \\ \ url https //your instance jomablue com/integration/api/auth \\ \ header 'authorization bearer \<long lived token>' \\ \ header 'user agent your system name' \\ \ header 'accept application/json' \\ \ header 'content type application/json' the short lived access token is returned in the data field example response { "success" true, "data" "\<short lived token>", "included" \[] } step 2 use the token on updates api requests take the value from data and send it as the bearer token on your updates api resource requests do not send your long lived token to these endpoints example request curl request get \\ \ url https //your instance jomablue com/updates/api/{endpoint uuid}/event people \\ \ header 'authorization bearer \<short lived token>' \\ \ header 'user agent your system name' \\ \ header 'accept application/json' when the short lived token expires, request a new one from the auth endpoint using your long lived token