Every REST API method except user/login requires an access token. There are two kinds of token: a permanent API token and a temporary JWT token.
How to pass the token
| Token kind | Where to get it | How to pass it | Lifetime |
|---|---|---|---|
| Permanent API token (UUID) | Personal account, access tokens section | token field in the request body | No expiry, or until the date set when the token was created |
| Temporary JWT token | The user/login method | Header token: <jwt-token> | 7 days by default; the company owner can set another period in the security settings |
If the request carries a token header with a valid JWT token, that token is used. Otherwise the system takes the token field from the request body.
A temporary token cannot be refreshed: when it expires, get a new one with user/login.
Permanent tokens can be managed through the API with the methods of the Access tokens section.
Examples
Permanent token in the request body
curl -X POST "https://api.neuro-vision.ru/v1/kyc/session/status" -H "Content-Type: application/json" -d '{"token": "00000000-0000-0000-0000-000000000000", "sessionId": "00000000-0000-0000-0000-000000000000"}'Temporary token in the header
curl -X POST "https://api.neuro-vision.ru/v1/kyc/session/status" -H "token: <jwt-token>" -H "Content-Type: application/json" -d '{"sessionId": "00000000-0000-0000-0000-000000000000"}'For multipart/form-data requests the permanent token is passed as a form field: -F "token=00000000-0000-0000-0000-000000000000".
Authorization errors
No token or the token is invalid (401)
{
"status": "error",
"message": "access denied"
}Check that the token is passed, has not expired and has not been deleted.
Wrong login or password in user/login (403)
{
"status": "error",
"message": "access denied"
}No permission for the method
If the user who owns the token lacks the required permission, the method answers with an error. Its format depends on the method and is described on the method's page. Permissions are assigned to users in the personal account, in the roles and permissions section.
The general list of errors is on the Errors page.
Recommendations
- Keep the permanent token on your server only. Do not pass it to a browser or a mobile app.
- Create a separate token for each integration, so you can revoke one without affecting the others.
- Set an expiry date on tokens for temporary integrations.
