Authentication

Authentication is based on the OAuth 2.0 workflow and requires you to register you application with the rescuetrack servicedesk. Once your registration has been approved, you will be provided with an AppID . This Id is solely to identify you application to our API. To get access to the actual client's data you need a ClientId and a ClientSecret.

Item	Description	Provided by
AppId	unique to every application you plan to distribute	rescuetrack
ClientId	unique to every customer installation	customer
ClientSecret	unique to every customer installation	customer
API Endpoints	used for authentication and API access	rescuetrack

warning

Each combination of AppId and ClientId has to be registered separetly. Please make sure to do that at least two weeks before your planned go live date.

tip

You should request a separate AppId for testing. Along with this AppId you will get a ClientId and ClientSecret for our Sandbox.

Roles

Each AppId is associated with (multiple) roles. These roles are used to grant access to sepcific API it's functions. Please make sure to include a list of all functions to be included in your AppId. Please keep in mind that these roles are also used to calculate the fee your customer is billed later. So make sure to only include necessary functions.

Workflow

To use restricted functions of the API you need a JSON Web Token. To retrieve said token you need to pass your credentials to our Authentation/Authorization server.

The details of the OAuth workflow are not covered in this documentation. Please make sure to read on this topic thoroughly.

warning

Tokens are only valid for a limited time. Please make sure to re-authenticate before the token expires!

Request

This request is used to request a bearer token. The response contains the issued token (access_token) along with it's lifespan (expires_in) in seconds.

Request

POST /api/auth/v1/getToken

{
  "appId": "d1700eb9-60a6-4f86-b773-f0532c34844b",
  "cliientId": "36ccf81b-4cd0-46d0-8c86-c01e76796c0d",
  "clientSecret": "IAQhbV08...EdVuI5TGv",
}

Response

POST /api/auth/v1/getToken

{
  "access_token":"eyJhbGciOiJ...dQssw5c",
  "token_type":"Bearer",
  "expires_in":86400
}