Skip to content
Open appSchedule a pilot

Get Token

POST/api/v1/oauth2/token

Issue OAuth access + refresh tokens for a user.

Returns standard access_token / refresh_token as Bearer credentials for all subsequent API calls.

SEC-031: the grant names a user by email and proves nothing about that person, so it never issues tokens for a DayZero superuser (403 AUTH_093) or an inactive account, and the route answers 404 unless enabled (OAUTH_TOKEN_ENDPOINT_ENABLED; by default only when OAUTH_CLIENT_SECRET is configured).

Operation ID: get_token·View as markdown·OpenAPI slice

Authentication

Bearer token authentication. Pass your DayZero API token in the Authorization header and the target business UUID in x-business-id.

Responses

200Successful Response

Schema: OAuthTokenResponse

access_tokenstringrequired

The access token (JWT)

token_typestring

Token type (always 'Bearer')

expires_inintegerrequired

Access token lifetime in seconds

refresh_tokenstring

Refresh token for obtaining new access tokens

scopestring

Granted scope (may differ from requested)

business_idstring

MCP grants bound to one business: that business's id. Absent when the grant reaches every business the user can.

business_namestring

MCP grants bound to one business: that business's name

422Validation Error

Schema: ErrorResponse

errorstringrequired

Error category: validation_error, unauthorized, forbidden, not_found, conflict, rate_limited, server_error, or service_unavailable.

messagestringrequired

Human-readable explanation, safe to show to end users.

codestringrequired

Stable machine-readable code in CATEGORY_NNN form (e.g. NOT_FOUND_006, AUTH_010, GEN_002).

request_idstring

Correlation id for support requests. Echoes the x-request-id request header when one was supplied.

errorsobject

Field-level validation messages keyed by field name. Present on 400/422 validation failures only.