Authentication

Obtain a JWT for use as a Bearer token on any Qvalia API

Create access token (JWT) for accountRegNo

get

/token/{accountRegNo}

Exchange an API key for a short-lived JWT access token, authenticating as accountRegNo (a Partner uses its own partnerRegNo here). The returned token can be used as a Bearer token (Authorization: Bearer <token>) on any Qvalia API endpoint as an alternative to the API key.

GET always authenticates as self; use POST if you need to act on behalf of a child account (actingAs: parent).

Tokens expire after one hour.

Authorizations

AuthorizationstringRequired

Path parameters

accountRegNostringRequired

Account registration number issued by Qvalia. A Partner uses its own partnerRegNo here.

Default: ""

Header parameters

AuthorizationstringRequired

API key for the account, sent as Authorization: ApiKey <api_key>

Example: 1234567890ABCDEF

Responses

200

OK

application/json

access_tokenstringOptional

token_typestringOptionalExample: Bearer

expires_inintegerOptionalExample: 3600

401

Unauthorized

422

Unprocessable Entity

500

Internal Server Error

get/token/{accountRegNo}

GET /token/{accountRegNo} HTTP/1.1
Host: api-qa.qvalia.com
Authorization: text
Accept: */*

{
  "access_token": "text",
  "token_type": "Bearer",
  "expires_in": 3600
}

Create access token (JWT) for accountRegNo, or on behalf of a child account

post

/token/{accountRegNo}

Exchange an API key for a short-lived JWT access token, authenticating as accountRegNo (a Partner uses its own partnerRegNo here).

• actingAs: self (default) — issue a token for accountRegNo itself.

• actingAs: parent — a Partner issues a token to act on behalf of a child account; forChildRegNo is required and the Partner must be authorized for that child. The token's sub claim will be the child account.

The request body may be omitted entirely, which is equivalent to {"actingAs": "self"}.

Tokens expire after one hour.

Authorizations

AuthorizationstringRequired

Path parameters

accountRegNostringRequired

Account registration number issued by Qvalia. A Partner uses its own partnerRegNo here.

Default: ""

Body

actingAsstring · enumOptional

Optional, defaults to "self". If "parent", forChildRegNo is required and the caller must be authorized to act on behalf of that child.

Default: selfExample: selfPossible values:

forChildRegNostringOptional

Required when actingAs is "parent"; the child account to act for.

Example: SE1234567890

Responses

200

OK

application/json

access_tokenstringOptional

token_typestringOptionalExample: Bearer

expires_inintegerOptionalExample: 3600

401

Unauthorized

422

Unprocessable Entity

500

Internal Server Error

post/token/{accountRegNo}

POST /token/{accountRegNo} HTTP/1.1
Host: api-qa.qvalia.com
Authorization: YOUR_API_KEY
Content-Type: application/json
Accept: */*
Content-Length: 50

{
  "actingAs": "self",
  "forChildRegNo": "SE1234567890"
}

{
  "access_token": "text",
  "token_type": "Bearer",
  "expires_in": 3600
}

Create access token (JWT) using client_id/client_secret

post

/token

Exchange client_id (your accountRegNo) and client_secret (your API key) for a short-lived JWT access token. Use this as an alternative to POST /token/{accountRegNo} when you'd rather not put accountRegNo in the URI and the API key in the Authorization header - for example, if your client is built around an OAuth2-style client-credentials exchange.

• actingAs: self (default) — issue a token for client_id itself.

• actingAs: parent — a Partner issues a token to act on behalf of a child account; forChildRegNo is required and the Partner (client_id) must be authorized for that child. The token's sub claim will be the child account.

There is no bodyless GET /token equivalent - GET always requires accountRegNo in the URI, see GET /token/{accountRegNo}.

Tokens expire after one hour.

Body

actingAsstring · enumOptional

Optional, defaults to "self". If "parent", forChildRegNo is required and the caller must be authorized to act on behalf of that child.

Default: selfExample: selfPossible values:

forChildRegNostringOptional

Required when actingAs is "parent"; the child account to act for.

Example: SE1234567890

client_idstringRequired

Your accountRegNo (a Partner uses its own partnerRegNo here).

Example: SE5567321707

client_secretstringRequired

Your API key.

Responses

200

OK

application/json

access_tokenstringOptional

token_typestringOptionalExample: Bearer

expires_inintegerOptionalExample: 3600

401

Unauthorized

422

Unprocessable Entity

500

Internal Server Error

post/token

POST /token HTTP/1.1
Host: api-qa.qvalia.com
Content-Type: application/json
Accept: */*
Content-Length: 100

{
  "actingAs": "self",
  "forChildRegNo": "SE1234567890",
  "client_id": "SE5567321707",
  "client_secret": "text"
}

{
  "access_token": "text",
  "token_type": "Bearer",
  "expires_in": 3600
}