Credentials

This token is required for accessing the API. it is the BEarer token

Api-Key header

Open. No token. Always send Api-Key as well.

Request body · application/json · AccessTokenRequest

Responses

Issues a short-lived token for browsing one tenant's public catalogue, without a secret.

Api-Key header

This API is multi-tenant and resolves its database from the caller's token, so even listing auctions needed a token — and the only way to get one was a client secret. That forced anything wanting to show a catalogue to hold a service credential, which a browser application cannot do safely and which carries far more authority than browsing needs.

The tenant is not a secret; it selects which public catalogue you see, and you can see thesame thing by visiting the website. So this asks for the tenant alone and returns a tokenthat carries it, marked as anonymous. It reaches only actions marked[AllowPublicToken]: the catalogue, and the flows that get a visitor signed in.Everything about a member needs a member token from POST /v1/sessions. The tenant is matched before it is used, never taken as given: againstPublicAccess:Tenants when that list is configured, otherwise against the registeredapplications. TenantService substitutes the tenant straight into a connection string, soan unchecked value would let a caller append their own connection parameters.

Request body · application/json · PublicTokenRequest

Responses

Reports whether the presented token is still valid.

Api-Key header

Open. No token. Always send Api-Key as well.

Responses