/
Exchange an authenticatio...

Exchange an authentication token

Request

Exchanges an authentication token for a JWT.

By default, this operation invalidates the exchanged authentication token.

Security
SecretApiKey or JWT or PublishableApiKey
Path
tokenstringrequired

ID of the authentication token.

Bodyapplication/jsonrequired
invalidatebooleanwrite-only

Specifies if the token must be invalidated after the exchange is performed.

Default:true
Example:true
oneTimePasswordstring^[0-9]{6}$write-only

One-time password that is sent by email. This value must contain digits only.

Example:"123456"
aclArray of objects(Acl)

Access Control List (ACL) information.

customClaimsobject
Example:
{
  "documents": [
    "identity-proof",
    "address-proof"
  ],
  "redirectUrl": "https://mywebsite.com"
}
expiredTimestring, (date-time)

Date and time when the session expires. The default value is one hour after the createdTime value.

curl -i -X POST \
  'https://www.rebilly.com/_mock/catalog/all/authentication-tokens/{token}/exchange' \
  -H 'Content-Type: application/json' \
  -H 'REB-APIKEY: YOUR_API_KEY_HERE' \
  -d '{
    "invalidate": true,
    "oneTimePassword": "123456",
    "acl": [
      {
        "scope": {
          "organizationId": [
            "organizationId-id-1"
          ]
        },
        "permissions": [
          "PostFile",
          "StorefrontGetAccount",
          "StorefrontGetWebsite",
          "StorefrontGetKycDocument",
          "StorefrontPostKycDocument"
        ]
      }
    ],
    "customClaims": {
      "documents": [
        "identity-proof",
        "address-proof"
      ],
      "redirectUrl": "https://mywebsite.com"
    },
    "expiredTime": "2019-08-24T14:15:22Z"
  }'

Responses

Authentication token exchanged for a JWT.

Headers
Locationstring, (uri)

Location of the related resource.

Example:"https://api.rebilly.com/example"
X-RateLimit-Limitinteger

Total number of rate limit tokens for this request within a rate limit period. For more information, see Rate limits.

Example:3600
X-RateLimit-Remaininginteger

Remaining number of rate limit tokens for this request within the rate limit period. For example, in the sandbox environment, rate limits for non-GET endpoints are set at 3000 requests per 10 minutes.

Example:3600
Bodyapplication/json
idstring, <= 50 charactersread-only

ID of the session.

Example:"jwt_0YV7DEJX80CDRAKVTV478ZNJDR"
typestringread-only

Type of session.

Value:"customer"
tokenstringread-only

Token used for authentication.

customerIdstring, <= 50 characters(CustomerId)read-only

ID of the customer resource.

Example:"cus_0YV7DDSDD1C8DA64KHH2W33CPF"
aclArray of objects(Acl)

Access Control List (ACL) information.

customClaimsobject
Example:
{
  "documents": [
    "identity-proof",
    "address-proof"
  ],
  "redirectUrl": "https://mywebsite.com"
}
createdTimestring, (date-time)(CreatedTime)read-only

Date and time when the resource is created. This value is set automatically when the resource is created.

updatedTimestring, (date-time)(UpdatedTime)read-only

Date and time when the resource is updated. This value is set automatically when the resource is updated.

expiredTimestring, (date-time)

Date and time when the session expires. The default value is one hour after the createdTime value.

Response
{
  "id": "jwt_0YV7DEJX80CDRAKVTV478ZNJDR",
  "type": "customer",
  "token": "string",
  "customerId": "cus_0YV7DDSDD1C8DA64KHH2W33CPF",
  "acl": [
    { … }
  ],
  "customClaims": {
    "documents": [ … ],
    "redirectUrl": "https://mywebsite.com"
  },
  "createdTime": "2019-08-24T14:15:22Z",
  "updatedTime": "2019-08-24T14:15:22Z",
  "expiredTime": "2019-08-24T14:15:22Z",
  "_links": [
    { … }
  ]
}