Flourish QMS

API reference / Authentication

Get an access token

POST/v1/oauth/token

No access token needed — this is the call that gets you one.

Exchanges your application's client_id and client_secret for a short-lived access token, carrying exactly the scopes your application was approved for. Call this first — every other /v1 endpoint needs the token it returns in the Authorization header. A token is valid for 1 hour and there's no refresh token, so just repeat this call once it expires (a 401 with code invalid_token from any other endpoint is your signal to).

Request bodyapplication/jsonrequired

  • client_idstringrequired
  • client_secretstringrequired

Responses

  • 200Access token issued
    Response fields
    • access_tokenstring
    • token_typestring
    • expires_ininteger
    • scopestring
  • 401Invalid client_id or client_secret
    Example response
    {
  "error": {
    "code": "invalid_client",
    "message": "Invalid client_id or client_secret."
  }
}