Herald
OpenapiOauth

Oauth_token

POST
/api/oauth/{realmId}/token

Path Parameters

realmId*string

Realm ID

Request Body

Dual encoding per openid-connect.md §5.1: JSON (first-party flow) or RFC 6749 §4.1.3 form-urlencoded (standard OIDC/MCP clients); both deserialize into the same snake_case field names. Grants: authorization_code (all clients), refresh_token (built-in MCP client only)

TypeScript Definitions

Use the request body type in TypeScript.

client_id?string|null
code?string|null
code_verifier?string|null
grant_type*string
redirect_uri?string|null
refresh_token?string|null
resource?|

RFC 8707 resource indicator. The MCP authorization_code exchange must repeat the code's resource; the refresh grant requires the bound resource.

scope?|

Refresh grant only: absent inherits the original scope set, an explicit value must equal it exactly.

Response Body

application/json

application/json

curl -X POST "https://example.com/api/oauth/string/token" \  -H "Content-Type: application/json" \  -d '{    "grant_type": "string"  }'
{  "access_token": "string",  "expires_in": 0,  "id_token": "string",  "refresh_expires_in": 0,  "refresh_token": "string",  "token_type": "string"}
{  "code": "string",  "details": null,  "message": "string",  "requestId": "string",  "status": 0}