Developer Guide > Developer Guide > Codebeamer Developer Tools > Designing APIs Using Swagger > Swagger Documented - REST-Based API > Swagger V3 > Swagger V3 Examples > Authentication > Web-based Authentication
Web-based Authentication
This topic lists the API endpoints for the web-based authentication for Codebeamer and third-party applications.
Getting Authorization Request 
The following endpoints gets the authorization request for Codebeamer.
After the request, the user agent redirects to a simplified Codebeamer login page with SSO and SAML, if configured. The client authenticates, and the user agent redirects to the registered URI.
URL
GET cb/api/oauth2/authorize.spr
Input Parameters
Parameter
Description
response_type=
REQUIRED. Value MUST be set to code.
client_id
REQUIRED. The authorization server issues the registered client a client identifier, a unique string representing the registration information provided by the client.
redirect_uri
OPTIONAL. The authorization server redirects the user-agent to the client's redirection endpoint previously established with the authorization server during the client registration process or when making the authorization request.
scope=API
OPTIONAL. The authorization server uses the scope response parameter to inform the client of the scope of the access token issued.
state=STATE
An opaque value used by the client to maintain state between the request and callback. The authorization server includes this value when redirecting the user-agent back to the client. The parameter is used for preventing cross-site request forgery
Request URL Example
GET cb/api/oauth2/authorize.spr?response_type=code&client_id=pv&redirect_uri=https://client_Eexample.com
Response Body Example
HTTP/1.1 302 Found
     Location: https://client.example.com/cb?code=SplxlOBeZQQYbYS6WxSbIA
               &state=xyz
Requesting Authorization 
The following endpoint requests authorization from the third-party client.
URL
POST cb/api/oauth2/token
Input Parameters
Parameter
Description
Authorization
The type of authorization to be used.
Content-Type
Specify the representation header to be used to indicate the originalmedia type.
grant_type
Value must be set to authorization_code.
redirect_uri
Scope of the request.
code
The authorization code received from the authorization server.
Request Body Example
Host: codebeamer-instance.com
     Authorization: Basic czZCaGRSa3F0MzpnWDFmQmF0M2JW
     Content-Type: application/x-www-form-urlencoded
     grant_type=authorization_code&code=SplxlOBeZQQYbYS6WxSbIA
     &redirect_uri=https://client_Eexample.com
Ouput Parameters
Parameter
Description
access_token
The access token issued by the authorization server.
token_type
The type of the token issued that provides the client with the information required to successfully utilize the access token to make a protected resource request. Value is case insensitive.
expires_in
The lifetime in seconds of the access token.
refresh_token
The refresh token, which can be used to obtain new access tokens using the same authorization grant.
Response Body Example
HTTP/1.1 200 OK
     Content-Type: application/json;charset=UTF-8
     {
       "access_token":"<accessToken>",
       "token_type":"tokenType",
       "expires_in":<time>,
       "refresh_token":"<refreshToken>",
}
Getting OpenID configuration 
The following endpoint provides static information on the authorization server, like specific endpoints and their supported authentication methods.
URL
GET {{baseURL}}/well-known/openid-configuration HTTP/1.1
Response Body Example
"authorization_endpoint": "http://codebeamer-instance.com/cb/api/oauth2/authorize.spr",
"token_endpoint": "http://codebeamer-instance.com/cb/api/oauth2/token",
"introspection_endpoint": "http://codebeamer-instance.com/cb/api/oauth2/introspection",
"revocation_endpoint": "http://codebeamer-instance.com/cb/api/oauth2/revoke",
"issuer": "http://codebeamer-instance.com/cb/api",
"jwks_uri": "http://codebeamer-instance.com/cb/api/oauth2/jwks_uri",
"scopes_supported": [
  "api"
],
"response_types_supported": [
  "code"
],
"response_modes_supported": [
  "query"
],
"grant_types_supported": [
  "authorization_code"
],
"token_endpoint_auth_methods_supported": [
  "client_secret_basic"
],
"introspection_endpoint_auth_methods_supported": [
  "client_secret_basic"
],
"revocation_endpoint_auth_methods_supported": [
  "client_secret_basic"
],
"request_uri_parameter_supported": true,
"subject_types_supported": [
  "public"
],
Was this helpful?