Session and logout
Send the token on protected routes
Send the token in the Authorization header of all protected calls:
export ACCESS_TOKEN='<access_token received>'
curl -s \
-H "Authorization: Bearer $ACCESS_TOKEN" \
-H 'Accept: application/json' \
"$API_BASE/stcpcore/v2/instances"Each route requires a permission in the operator scope. Without it, the API responds 403.
Expiration
The token is valid for 60 minutes by default. The time is set in session_duration in the API config.json, up to a maximum of 720 minutes (12 hours).
When a protected route responds 401 (text Unauthorized), sign in again and repeat the call.
End the session
curl -s -X DELETE \
-H "Authorization: Bearer $ACCESS_TOKEN" \
-H 'Accept: application/json' \
"$API_BASE/disconnect/api/v3/logout"{
"data": "Logout successful",
"redirect": "<logout address at the identity provider>"
}After logout, the token is no longer valid.
The redirect field only appears when the operator signed in through SSO and sso_logout_end_session is enabled. In that case, redirect the browser to the address received, to also end the session at the identity provider.