OAuth 2.0

Authorization code grant

Mindful Feedback users with administrator privileges can create OAuth clients in the Integrations tab of the Customer Settings page.

We use the standard OAuth 2.0 authorization code flow. To start, the client application must redirect the user to the authorization endpoint at http://surveydynamix.com/oauth/authorize. The redirect must include the following parameters:

Once the user has been redirected, they will be presented with a form allowing them to either approve or cancel the request. If the request is approved, the user will be redirected back to the redirect URL. This redirect will include an authorization code.

To convert the authorization code into an access token, the client application must make a final POST request to the access token endpoint at http://surveydynamix.com/oauth/token with the following parameters:

• grant_type — Set this to to authorization_code.

• client_id — This is listed in the OAuth Clients table after you have created a client.

• client_secret — This is listed in the OAuth Clients table and should be kept secure.

• redirect_uri — This must match the redirect URL that was specified when creating the client and will be used for the callback endpoint when the user grants access.

• code — Use the authorization code included in the post-authorization redirect.

This request will return a JSON response containing the access_token attribute.

To authenticate using an access token, add an authorization header to each request in the following format:

# Pass the access token as part of the Authorization header with each request

curl "api_endpoint_here" \
  -H "Authorization: Bearer {Token}"

Refresh access tokens

The refresh token grant type is used by clients to exchange a refresh token for an access token when the access token has expired.

• URI — /oauth/token

• Method — POST

• Parameters — Consult the table below.

The following example demonstrates using a refresh token:

curl -X POST   "https://surveydynamix.com/api/oauth/token" \
    -d "grant_type=refresh_token" \
    -d "refresh_token=xxxxxx" \
    -d "client_id=xxxxxx" \
    -d "client_secret=xxxxxx"

Personal access token

Users with administrator privileges can create personal access tokens in the Integrations tab of the Customer Settings page to authenticate API requests.

Personal access tokens are shown to the user only once upon creation and should be stored securely.

To authenticate using a personal access token, add an Authorization header to each request in the following format:

# Pass the personal access token as part of the Authorization header with each request

curl "api_endpoint_here" \
  -H "Authorization: Bearer {Token}"

Basic authentication

Basic authentication is the simplest method available. You can use your customer UUID as the username and your Auth Token as the password. You can find your authentication credentials in the Customer Credentials tab of the Customer Settings page.

• Username: Customer UUID

• Password: Auth Token

The following example demonstrates basic authentication:

# Pass the default API credentials with each request

curl "api_endpoint_here" \
  -u {CustomerUUID}:{AuthToken}