\n\nThis page documents the legacy TT OAuth2 system. It has been replaced by a Keycloak-based\nimplementation. See the current authentication documentation for the new system.
\n
The Media and Content APIs support OAuth2 bearer authentication.\nYou can obtain a client_id and client_secret here, which you can use to issue access tokens, either using the\nregular Authorization Code Grant (for web apps), Implicit Grant (for\nsingle-page web apps) or Password Grant (server-side apps).
We support the following endpoints:
\n| Name | \nURL | \n
|---|---|
| authorization endpoint | \nhttps://tt.se/o/oauth2/auth | \n
| token endpoint | \nhttps://tt.se/o/oauth2/token | \n
| user endpoint | \nhttps://tt.se/o/v2/user | \n
We define the following scopes, which determine which user information fields\nare exposed to the holder of the access_token. For API access to work, the\ntoken need to be issued with at least roles scope.
| Scope | \nDescription | \n
|---|---|
Include email, the user email address. | \n|
| roles | \nInclude roles, an array of role names assumed by the user. | \n
| user | \nInclude the user-specific fields name, family_name and given_name and user_id (if available) | \n
| customer | \nInclude the customer-specific fields customer_id, customer_name and department (if available) | \n
| profile | \nAllow access to view and update user profile. | \n
| collection | \nAllow access to view and update user collections. | \n
| admin | \nAllow access to the organization user admin endpoints, provided the user has user admin privileges. | \n
Do note that the while profile and collection scopes are\nimplemented in the OAuth2 service, there are currently no APIs that\nuse them. There are plans to change the endpoints\napi.tt.se/content/v1/profile and api.tt.se/content/v1/collection\nto require these scopes in the future.
We define the following well-known user roles.
\n| Name | \nMeaning | \n
|---|---|
| ROLE_TT | \nUser is a TT employee. | \n
| ROLE_OFP | \nUser is a TT customer. | \n
| ROLE_MEDIEBANK | \nUser has access to the Mediabank. | \n
The Client ID is a non-secret string that identifies an app or integration. It\nis paired with a Client Secret, both of which are necessary for issuing\naccess_tokens.
Manage your Client ID/Secret here.
\nOAuth2 offers several ways for clients to obtain an access_token. Developers\nwriting integrations running as a single user will probably use Password\nGrant.
A sample call using curl looks like this:
\ncurl -XPOST -d username=<username> \\\n -d password=<password> \\\n -d client_id=<client_id> \\\n -d client_secret=<client_id> \\\n -d grant_type=password \\\n -d scope=\"roles\"\n https://tt.se/o/oauth2/tokenusername and password should be the regular TT login credentials.client_id is the (non-secret) client ID issued by TT.client_secret is the client secret issued by TT.scope is a space-separated list of scope names (see above). It needs to\ninclude roles for API access to work; the other scopes are optional.You will get a JSON result like this:
\n{\n \"access_token\": \"a.n2Oc_XqcuBqe5RjLtiEnasIoRyB62As6JxsmwVHAaxq7DMLqRm43Qe0qzPgh37nvJfaP8x1EWA6GNTRG0ibsj0ZlMGHo7ev27zLb_lNQEnk\",\n \"refresh_token\": \"r.4LyAp206TaQzeQTee1LvHyLmWSVvXeTM8IIIY__5BF9dLkpEXqbTMg\",\n \"expires_in\": 2592000,\n \"id_token\": \"eyJhbGciOiJFUzM4NCIsInR5cCI6IkpXVCIsImtpZCI6IjdDZjVqR2JuS2dLdUFYZElSeXpJdnRfaGYtOVZ1YmYyVzlBbHBUMzg1eWciLCJqa3UiOiJodHRwczovL3R0LnNlL28vb2F1dGgyL2NlcnRzIn0.eyJzdWI\niOiJmcmVkcmlrLmFwcGVsYmVyZyIsInNjb3BlIjoicm9sZXMiLCJyb2xlcyI6WyJST0xFX09GUF9BRE1JTiIsIlJPTEVfREVXQVJfU0VORCZVU0VSIiwiUk9MRV9ERVdBUl9VU0VSIiwiUk9MRV9JVERSSUZUIiwiUk9MRV9JVFVUViIsI\nlJPTEVfU0dCIiwiUk9MRV9TQ0FOUElYIiwiUk9MRV9UVCIsIlJPTEVfQ09ORkxVRU5DRSIsIlJPTEVfREFTSEJPQVJEX0FETUlOIl0sImlhdCI6MTU2MjMxNjEwNSwibmJmIjoxNTYyMzE2MTA0LCJleHAiOjE1NjI5MjA5MDUsImF1ZCI\n6WyJhb0pydXN2dF9QenZlNFhoazNwWFM5YzhwUDlOaUNrdmpIVnJ5eUphQWtBIl0sImlzcyI6Imh0dHBzOi8vdHQuc2UifQ.gKn90_M015Ue51GLisbf3Ezrij3PzcXZTTvnACVGn4FNO4NGlnjVKJgtVKFADIzgLiX-6EgOaJbQDrwrknapQptQUponAYrX39_Q1BCwF7OxQd0MCaevZesWj9dB3uSx\",\n \"token_type\": \"Bearer\"\n}access_token is your access token. It should be passed al in the\nAuthorization header when making API calls.refresh_token can be used to generate new tokens after they expire.id_token is a JWT object representing your user.When exploring the API and using the examples in the Content API\nsection it is conventient to export the token as an environment variable:
\nexport TOKEN=a.n2Oc_XqcuBqe5RjLtiEnasIoRyB62As6JxsmwVHAaxq7DMLqRm43Qe0qzPgh37nvJfaP8x1EWA6GNTRG0ibsj0ZlMGHo7ev27zLb_lNQEnkThe access_token is valid for 7 days. When it expires you can use the\nrefresh_token to generate a new set of tokens without having to supply\nusername and password:
curl -XPOST -d client_id=<client_id> \\\n -d client_secret=<client_secret> \\\n -d grant_type=refresh_token \\\n -d refresh_token=<refresh_token> \\\n https://tt.se/o/oauth2/tokenRefreshing will invalidate the original access_token if it wasn't already\nexpired.
Once an access_token has been obtained, it can be used to make authenticated\nrequests to the Media API and Content API by passing it\nin the HTTP Authorization header.
GET /content/v1/text/search HTTP/1.1\nHost: api.tt.se\nAuthorization: Bearer a.n2Oc_XqcuBqe5RjLtiEnasIoRyB62As6JxsmwVHAaxq7DMLqRm43Qe0qzPgh37nvJfaP8x1EWA6GNTRG0ibsj0ZlMGHo7ev27zLb_lNQEnkaccess_tokens can be verified by calling the user endpoint (see\nEndpoints above) with an Authorization header:
curl -H \"Authorization: Bearer $TOKEN\" https://tt.se/o/v2/userIf the token is valid, the call will return HTTP 200 and a JSON structure\ncontaining the fields defined by the scopes used to issue the token.
\n{ \"sub\": \"username\",\n \"scope\": \"roles profile email\",\n \"roles\": [\n \"ROLE_OFP\",\n ...\n ],\n \"name\": \"Firstname Lastname\",\n \"family_name\": \"Lastname\",\n \"given_name\": \"Firstname\",\n \"email\": \"user@domain.com\"\n}If the token is invalid or has expired, tthe call will instead return HTTP 401\n(Unauthorized).
\nWe support OpenID Connect. The configuration can be found\nhere.
","headings":[{"value":"Endpoints","depth":2},{"value":"Scopes","depth":2},{"value":"Roles","depth":3},{"value":"Client ID and secrets","depth":2},{"value":"Issuing access_tokens","depth":2},{"value":"Refreshing access_tokens","depth":2},{"value":"Making authenticated requests","depth":2},{"value":"Verifying access_tokens","depth":2},{"value":"OpenID Connect","depth":2}]}},"pageContext":{"slug":"/api/oauth2-legacy/"}},"staticQueryHashes":["3096394494"]}