Obit API Documentation

Notes

• Text like this is to be replaced in the request.
• In the request/response examples, the headers are separated from the body
• In the future, all requests will be required to be sent over HTTPS
• Unnecessary headers have been removed from the examples

Authorization Process

• Signing up is equivalent to posting a new account
• Logging in is equivalent to obtaining a new access token

Requesting an access token

Request

POST /api/users/login

grant_type=password&username=bill@ie.ca&password=secretdfdf&client_id=id

Response (Valid user/pass and client id)

200 OK

{
    "access_token":"0TGwHvV1i7TXzWjkJNEZBKtj4fZ4bmiZYoYOAEHmPoaNAH...",
    "token_type":"bearer",
    "expires_in":299,
    "refresh_token":"E18E01596CA5D88D7490C3...",
    "user_id":"0a22a38c-d89e-47c9-8e64-32118c2d54ef"
}

Response (Invalid/not present client id)

400 Bad Request

{
    "error":"invalid_client",
    "error_description":"Invalid Client ID"
}

Response (Valid client id, invalid user/pass)

400 Bad Request

{
    "error":"invalid_user_credentials",
    "error_description":"Incorrect email/password combination"
}

Passing the access token to a protected resource

Request

GET /api/users/0a22a38c-d89e-47c9-8e64-32118c2d54ef/matches
Authorization: Bearer 0TGwHvV1i7TXzWjkJNEZBKtj4fZ4bmiZYoYOAEHmPoaNAH...

Response (Valid access token)

200 OK

[
  {
    "id": 0,
    "deceasedFirstName": "Mary",
    "deceasedLastName": "Jesso",
    "deceasedWebsite": "https://www.inmemoriam.ca/view-announcement-471685-mary-sylvia-jesso.html",
    "noteSentDate": "2015-06-26T10:25:14.940109-03:00",
    "noteRead": false,
    "score": 100
  }
]

Response (Invalid/not present access token)

401 Unauthorized

{
    "error":"unauthorized",
    "error_description":"Authorization has been denied for this request"
}

Using the refresh token to request new access & refresh tokens once the original access token has expired

Note that currently, the old refresh token is removed once the new one has been issued - You'll need to use the newer refresh token once your new access token has expired

Request

POST /api/users/login

grant_type=refresh_token&client_id=id&refresh_token=E18E01596CA5D88D7490C3...

Response (Valid refresh token)

200 OK

{
    "access_token":"28a0UFNF0D5XFtokbMGO9EHek1WgilWG-Bm3m...",
    "token_type":"bearer",
    "expires_in":299,
    "refresh_token":"6E783FA2E7049D6C02FC9B..."
    "user_id":"0a22a38c-d89e-47c9-8e64-32118c2d54ef"
}

Response (Invalid refresh token)

400 Bad Request

{
    "error":"invalid_grant"
}