Authentication

This group refers to endpoints related to authentication.

Get all Permissions

get

/v2/auth/permissions

Retrieves all resources that the passed authentication token is currently authorized to access. Nomenclature matches the API reference page in settings.

This is an API configuration endpoint and does not correspond to a specific frontend page.

Authorizations

AuthorizationstringRequired

OAuth 2.0 Bearer token obtained via client credentials grant. Pass the token in the Authorization header as Bearer <token>.

Responses

200

Success

application/json

permissionsstring[]OptionalExample: students/excusals/index

get/v2/auth/permissions

GET /v2/auth/permissions HTTP/1.1
Host: api.managebac.com
Authorization: Bearer YOUR_SECRET_TOKEN
Accept: */*

200

Success

{
  "permissions": [
    "students/excusals/index"
  ]
}

Obtain an Access Token

post

/oauth/token

Obtain an OAuth 2.0 access token using the Client Credentials grant. Pass your application's client_id and client_secret along with grant_type=client_credentials. Optionally request a subset of the scopes configured on the application. The returned Bearer token can then be used in the Authorization header for all other API endpoints.

Body

grant_typestring · enumRequired

The OAuth 2.0 grant type. Only client_credentials is supported for server-to-server API access.

Possible values:

client_idstringRequired

The client_id (Application ID) of your OAuth application.

client_secretstringRequired

The client_secret of your OAuth application.

scopestringOptional

A space-separated list of scopes to request. Must be a subset of the scopes configured on the application. If omitted, all scopes defined on client creation will be granted.

Responses

200

Token issued successfully

application/json

access_tokenstringRequired

The Bearer token (JWT) to use in the Authorization header.

token_typestring · enumRequired

Always Bearer.

Possible values:

expires_inintegerRequired

Token lifetime in seconds.

Example: 3600

scopestringRequired

Space-separated list of granted scopes.

created_atintegerRequired

Token creation timestamp (Unix epoch).

400

Invalid scope requested

application/json

401

Invalid client credentials

application/json

post/oauth/token

POST /oauth/token HTTP/1.1
Host: api.managebac.com
Content-Type: application/json
Accept: */*
Content-Length: 92

{
  "grant_type": "client_credentials",
  "client_id": "text",
  "client_secret": "text",
  "scope": "text"
}

{
  "access_token": "text",
  "token_type": "Bearer",
  "expires_in": 3600,
  "scope": "text",
  "created_at": 1
}