Client Authentication

HealthHero APIs use the OAuth 2.0 protocol for authentication and authorisation.

The flow looks similar to the following diagram:

Where:

1. Your app authenticates with the HealthHero Authorisation Server using its Client ID and Client Secret.
2. The HealthHero Authorisation Server validates the Client ID and Client Secret and responds with an Access Token.
3. Your application can use the Access Token to call one of the HealthHero APIs.
4. The HealthHero API responds with requested data.

Prerequisites

To begin, you will need to obtain your client credentials contacting our support / registering or to try our APIs out request a trial.

Once you have obtained your credentials, in the form of a CLIENT_ID and a CLIENT_SECRET you will need to configure you application to request a token.

Request a token

1curl --request POST \
2  --url 'https://<paste_Identity_Url_here>/connect/token' \
3  --header 'content-type: application/x-www-form-urlencoded' \
4  --data grant_type=client_credentials \
5  --data client_id=CLIENT_ID \
6  --data client_secret=CLIENT_SECRET

Parameters

| Parameter Name | Description | |--|--| | grant_type | Set this to "client_credentials". | | client_id | Your application's Client ID. | | client_secret| Your application's Client Secret. |

Response

You'll receive an HTTP 200 response with a payload containing access_token, token_type, and expires_in values:

1{
2 "access_token":YOUR_ACCESS_TOKEN,
3 "token_type":"Bearer",
4 "expires_in":3600,
5 ...
6}

The access_token is in the format of a JSON Web Token (JWT). JWT is an is an open standard (RFC 7519) that defines a compact and self-contained way for securely transmitting information between parties as a JSON object.

Call the HealthHero API

To call the HealthHero API from your application, the application must pass the access_token as a Bearer token in the Authorization header of your HTTP request.

1curl --request GET \
2  --url https://<paste-Traversal-Url-here>/api/v1/CLIENT_ID/traversal \
3  --header 'authorization: Bearer ACCESS_TOKEN' \
4  --header 'content-type: application/json'

where:

• CLIENT_ID is your application client ID.
• ACCESS_TOKEN is the JWT Token received from the request above.