OTP - Completion

TOTP Provisioning Completion

The TOTP Provisioning Completion API is the second part of the TOTP provisioning process. The user sends the OTP code generated by their authenticator app and the totpSecret received during provisioning initiation. On successful verification, the server responds with a JSON Web Token (JWT) containing the newly provisioned credential ID.

API Description

Method : POST

URL : Follow up url received as part of the response of the Transaction Initiation API

Parameters

Name	Type	Description
client_id*	String	A unique client id that is shared for each partner.
totp*	String	TOTP code from the authenticator.
totpSecret*	String	totpSecret value received part of the Transaction Initiation request

Headers

Name	Type	Description
Authorization*	String	Bearer {Bearer Token Received in Transaction Initiation API}
Content-Type	String	application/x-www-form-urlencoded

200: OK

{
    "entity": {
        "accessToken": "eyJhbGciOiJSUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICJYbnNBNFVPdlkyU0JLSkdnX1ppTHN1Tk8tZ2dlLVB0RXZzX2twRTBhd3RnIn0.eyJleHAiOjE3MDM1Nzc4NzAsIm5iZiI6MTcwMzU3NzU3MCwiaWF0IjoxNzAzNTc3NTcwLCJhdXRoX3RpbWUiOjE3MDM1Nzc1NzAsImp0aSI6ImY0ZmVmYzMxLTZkNjktNDBiOC1hMGJlLTY4MzM1OWM5ZTlkNyIsImlzcyI6Imh0dHBzOi8va2V5Y2xvYWsuYXV0aC1zdGFnZS52aWRhLmlkL3JlYWxtcy9zcHJpbmdib290LXF1aWNrc3RhcnQiLCJzdWIiOiIxMGQ3MTJhMi02NmIyLTQ5NzktOTJiYS1iMDlmMDRkMzAzYmQiLCJ0eXAiOiJCZWFyZXIiLCJhenAiOiJhcGkiLCJzZXNzaW9uX3N0YXRlIjoiNGRhMWI1MTctNjQ5MS00NDhhLTllZGYtZWZlOGFkMGQxNjY4Iiwic2NvcGUiOiIiLCJzaWQiOiI0ZGExYjUxNy02NDkxLTQ0OGEtOWVkZi1lZmU4YWQwZDE2NjgiLCJzZXNzaW9uX2lkZW50aWZpZXIiOiJXU3FOZnFiWWdUZyIsInR5cGUiOiJvdHAiLCJjcmVkZW50aWFsX2lkIjoiNjQ3MDc0NzMtNDdmZi00ZGFlLTk3N2QtMGUxNmVhYmMyMTUwIn0.MSf0OZU741XqDzUUb6fSnE9gED-T6VWJxycNsaCDYqrb4PrRxEI3ieabPuMATYEGso0nrFHss_YQQbg0fzhGS8xcJoZ-Wg4S_zPT5-NulrYER397_tUoQDJ_du_ziehfWpHYasDDepzPfuEi5A-sr6GZXmSSDh_L4cthcLRUFAK3wwtfpbA-cMl_yaizcO_nVCWLHCvhPrnA8sr2sHIXaMGTju728RRMzwYW3sI8_5AJ74upfJYPfA62bZ5WbO7fiObnt-WMENYbeimRANNSshu9unN-Y8mHJyh05lcgQ9L-QHWImlbyPPeLiheHN2cPlrdEX28g2bF43OtGHSxJNw",
        "accessExpiresIn": 300,
        "refreshToken": "eyJhbGciOiJIUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICJmMjFhZGYyZS03NWU2LTQ5Y2UtOWYwZi00ZDEwNjE0MDA4NGEifQ.eyJleHAiOjE3MDM1NzkzNzAsImlhdCI6MTcwMzU3NzU3MCwianRpIjoiM2YyOGVjMWEtMmViNC00NmUxLWI0NDQtNDM3MTFmMzY3YTNmIiwiaXNzIjoiaHR0cHM6Ly9rZXljbG9hay5hdXRoLXN0YWdlLnZpZGEuaWQvcmVhbG1zL3NwcmluZ2Jvb3QtcXVpY2tzdGFydCIsImF1ZCI6Imh0dHBzOi8va2V5Y2xvYWsuYXV0aC1zdGFnZS52aWRhLmlkL3JlYWxtcy9zcHJpbmdib290LXF1aWNrc3RhcnQiLCJzdWIiOiIxMGQ3MTJhMi02NmIyLTQ5NzktOTJiYS1iMDlmMDRkMzAzYmQiLCJ0eXAiOiJSZWZyZXNoIiwiYXpwIjoiYXBpIiwic2Vzc2lvbl9zdGF0ZSI6IjRkYTFiNTE3LTY0OTEtNDQ4YS05ZWRmLWVmZThhZDBkMTY2OCIsInNjb3BlIjoiIiwic2lkIjoiNGRhMWI1MTctNjQ5MS00NDhhLTllZGYtZWZlOGFkMGQxNjY4In0.DfCuvPluy_XLPAq5zP081Q6tldHkzNxb-K-NChSMCmw",
        "refreshExpiresIn": 1800,
        "authType": "otp"
    },
    "uri": "https://{environment-url}/realms/{partner-id}/protocol/api/required-action",
    "bearerToken": "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJzdWIiOiI0ZGExYjUxNy02NDkxLTQ0OGEtOWVkZi1lZmU4YWQwZDE2NjgiLCJleGVjdXRpb24iOiJDT05GSUdVUkVfVE9UUCIsInRhYl9pZCI6IldTcU5mcWJZZ1RnIiwibmJmIjoxNzAzNTc3NTcwLCJzZXNzaW9uX2NvZGUiOiJCU2NlX1ZEN2oxRThyMG1KTTFQYTBhVDhZWFpQMWtxWW5Hd04zaGxUb1c0Iiwic2Vzc2lvbl9pZGVudGlmaWVyIjoiV1NxTmZxYllnVGciLCJleHAiOjE3MDM1Nzc4NzAsImlhdCI6MTcwMzU3NzU3MCwiYXV0aF9zZXNzaW9uX2lkIjoiNGRhMWI1MTctNjQ5MS00NDhhLTllZGYtZWZlOGFkMGQxNjY4IiwianRpIjoiNWEwODQ3MWQtMDc3Yi00YWI5LTlhYWItMDg3MjQ1M2FhMDVhIn0.jOXhKWj9DPT1xWGD0LjLShY0PEDNQ9RSa22AkepXQCE",
    "authType": "otp"
}

Curl

curl --location -g --request POST '{{FOLLOW UP URI RECEIVED AS PART OF THE TRANSACTION INITIATION REQUEST}}' \
--header 'Authorization: Bearer <Bearer Token>' \
--header 'Content-Type: application/x-www-form-urlencoded' \
--data-urlencode 'totp=156088' \
--data-urlencode 'client_id=<client_id>'

Python

import requests

url = "{{FOLLOW UP URI RECEIVED AS PART OF THE TRANSACTION INITIATION REQUEST}}"

payload='totp=156088&client_id=%3Cclient_id%3E'
headers = {
  'Authorization': 'Bearer <Bearer Token>',
  'Content-Type': 'application/x-www-form-urlencoded'
}

response = requests.request("POST", url, headers=headers, data=payload)

print(response.text)

NodeJS

var axios = require('axios');
var qs = require('qs');
var data = qs.stringify({
  'totp': '156088',
  'client_id': '<client_id>' 
});
var config = {
  method: 'post',
  url: '{{FOLLOW UP URI RECEIVED AS PART OF THE TRANSACTION INITIATION REQUEST}}',
  headers: { 
    'Authorization': 'Bearer <Bearer Token>', 
    'Content-Type': 'application/x-www-form-urlencoded'
  },
  data : data
};

axios(config)
.then(function (response) {
  console.log(JSON.stringify(response.data));
})
.catch(function (error) {
  console.log(error);
});

Java

OkHttpClient client = new OkHttpClient().newBuilder()
  .build();
MediaType mediaType = MediaType.parse("application/x-www-form-urlencoded");
RequestBody body = RequestBody.create(mediaType, "totp=156088&client_id=<client_id>");
Request request = new Request.Builder()
  .url("{{FOLLOW UP URI RECEIVED AS PART OF THE TRANSACTION INITIATION REQUEST}}")
  .method("POST", body)
  .addHeader("Authorization", "Bearer <Bearer Token>")
  .addHeader("Content-Type", "application/x-www-form-urlencoded")
  .build();
Response response = client.newCall(request).execute();

C#

var client = new RestClient("{{FOLLOW UP URI RECEIVED AS PART OF THE TRANSACTION INITIATION REQUEST}}");
client.Timeout = -1;
var request = new RestRequest(Method.POST);
request.AddHeader("Authorization", "Bearer <Bearer Token>");
request.AddHeader("Content-Type", "application/x-www-form-urlencoded");
request.AddParameter("totp", "156088");
request.AddParameter("client_id", "<client_id>");
IRestResponse response = client.Execute(request);
Console.WriteLine(response.Content);

PHP

<?php

$curl = curl_init();

curl_setopt_array($curl, array(
  CURLOPT_URL => '%7B%7BFOLLOW%20UP%20URI%20RECEIVED%20AS%20PART%20OF%20THE%20TRANSACTION%20INITIATION%20REQUEST%7D%7D',
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => '',
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 0,
  CURLOPT_FOLLOWLOCATION => true,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => 'POST',
  CURLOPT_POSTFIELDS => 'totp=156088&client_id=%3Cclient_id%3E',
  CURLOPT_HTTPHEADER => array(
    'Authorization: Bearer <Bearer Token>',
    'Content-Type: application/x-www-form-urlencoded'
  ),
));

$response = curl_exec($curl);

curl_close($curl);
echo $response;

Success Response

The (JWT)access token issued after a successful OTP verificationwill include the provisioned credential id which can be used for the subsequent request pertaining to the user. The signed JWT tokens contain parameters along with corresponding explanations.

{
    "entity": {
        "accessToken": "eyJhbGciOiJSUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICJYbnNBNFVPdlkyU0JLSkdnX1ppTHN1Tk8tZ2dlLVB0RXZzX2twRTBhd3RnIn0.eyJleHAiOjE3MDM1Nzc4NzAsIm5iZiI6MTcwMzU3NzU3MCwiaWF0IjoxNzAzNTc3NTcwLCJhdXRoX3RpbWUiOjE3MDM1Nzc1NzAsImp0aSI6ImY0ZmVmYzMxLTZkNjktNDBiOC1hMGJlLTY4MzM1OWM5ZTlkNyIsImlzcyI6Imh0dHBzOi8va2V5Y2xvYWsuYXV0aC1zdGFnZS52aWRhLmlkL3JlYWxtcy9zcHJpbmdib290LXF1aWNrc3RhcnQiLCJzdWIiOiIxMGQ3MTJhMi02NmIyLTQ5NzktOTJiYS1iMDlmMDRkMzAzYmQiLCJ0eXAiOiJCZWFyZXIiLCJhenAiOiJhcGkiLCJzZXNzaW9uX3N0YXRlIjoiNGRhMWI1MTctNjQ5MS00NDhhLTllZGYtZWZlOGFkMGQxNjY4Iiwic2NvcGUiOiIiLCJzaWQiOiI0ZGExYjUxNy02NDkxLTQ0OGEtOWVkZi1lZmU4YWQwZDE2NjgiLCJzZXNzaW9uX2lkZW50aWZpZXIiOiJXU3FOZnFiWWdUZyIsInR5cGUiOiJvdHAiLCJjcmVkZW50aWFsX2lkIjoiNjQ3MDc0NzMtNDdmZi00ZGFlLTk3N2QtMGUxNmVhYmMyMTUwIn0.MSf0OZU741XqDzUUb6fSnE9gED-T6VWJxycNsaCDYqrb4PrRxEI3ieabPuMATYEGso0nrFHss_YQQbg0fzhGS8xcJoZ-Wg4S_zPT5-NulrYER397_tUoQDJ_du_ziehfWpHYasDDepzPfuEi5A-sr6GZXmSSDh_L4cthcLRUFAK3wwtfpbA-cMl_yaizcO_nVCWLHCvhPrnA8sr2sHIXaMGTju728RRMzwYW3sI8_5AJ74upfJYPfA62bZ5WbO7fiObnt-WMENYbeimRANNSshu9unN-Y8mHJyh05lcgQ9L-QHWImlbyPPeLiheHN2cPlrdEX28g2bF43OtGHSxJNw",
        "accessExpiresIn": 300,
        "refreshToken": "eyJhbGciOiJIUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICJmMjFhZGYyZS03NWU2LTQ5Y2UtOWYwZi00ZDEwNjE0MDA4NGEifQ.eyJleHAiOjE3MDM1NzkzNzAsImlhdCI6MTcwMzU3NzU3MCwianRpIjoiM2YyOGVjMWEtMmViNC00NmUxLWI0NDQtNDM3MTFmMzY3YTNmIiwiaXNzIjoiaHR0cHM6Ly9rZXljbG9hay5hdXRoLXN0YWdlLnZpZGEuaWQvcmVhbG1zL3NwcmluZ2Jvb3QtcXVpY2tzdGFydCIsImF1ZCI6Imh0dHBzOi8va2V5Y2xvYWsuYXV0aC1zdGFnZS52aWRhLmlkL3JlYWxtcy9zcHJpbmdib290LXF1aWNrc3RhcnQiLCJzdWIiOiIxMGQ3MTJhMi02NmIyLTQ5NzktOTJiYS1iMDlmMDRkMzAzYmQiLCJ0eXAiOiJSZWZyZXNoIiwiYXpwIjoiYXBpIiwic2Vzc2lvbl9zdGF0ZSI6IjRkYTFiNTE3LTY0OTEtNDQ4YS05ZWRmLWVmZThhZDBkMTY2OCIsInNjb3BlIjoiIiwic2lkIjoiNGRhMWI1MTctNjQ5MS00NDhhLTllZGYtZWZlOGFkMGQxNjY4In0.DfCuvPluy_XLPAq5zP081Q6tldHkzNxb-K-NChSMCmw",
        "refreshExpiresIn": 1800,
        "authType": "otp"
    },
    "uri": "https://{environment-url}/realms/{partner-id}/protocol/api/required-action",
    "bearerToken": "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJzdWIiOiI0ZGExYjUxNy02NDkxLTQ0OGEtOWVkZi1lZmU4YWQwZDE2NjgiLCJleGVjdXRpb24iOiJDT05GSUdVUkVfVE9UUCIsInRhYl9pZCI6IldTcU5mcWJZZ1RnIiwibmJmIjoxNzAzNTc3NTcwLCJzZXNzaW9uX2NvZGUiOiJCU2NlX1ZEN2oxRThyMG1KTTFQYTBhVDhZWFpQMWtxWW5Hd04zaGxUb1c0Iiwic2Vzc2lvbl9pZGVudGlmaWVyIjoiV1NxTmZxYllnVGciLCJleHAiOjE3MDM1Nzc4NzAsImlhdCI6MTcwMzU3NzU3MCwiYXV0aF9zZXNzaW9uX2lkIjoiNGRhMWI1MTctNjQ5MS00NDhhLTllZGYtZWZlOGFkMGQxNjY4IiwianRpIjoiNWEwODQ3MWQtMDc3Yi00YWI5LTlhYWItMDg3MjQ1M2FhMDVhIn0.jOXhKWj9DPT1xWGD0LjLShY0PEDNQ9RSa22AkepXQCE",
    "authType": "otp"
}

Error Response

{
    "error": "invalid_request",
    "errorDescription": "Client ID invalid"
}

Response Schema

{
    "error": "{TYPE OF ERROR}",
    "errorDescription": "{REASONING FOR THE ERROR}"
}

For a complete list of error codes and their meanings, refer to the Error Scenarios section.

TOTP Authentication API

The TOTP Authentication API is used when a user wants to authenticate their identity using the OTP method. After initiating a request for authentication, the server will respond with a session ID, bearer token, and a challenge. The user will respond to this challenge by generating and submitting the OTP from their chosen authenticator app. The API will validate this OTP against the secret stored during the provisioning phase.

API Description

Method : POST

URL : Follow up url received as part of the response of the Transaction Initiation API

Parameters

Name	Type	Description
client_id*	String	A unique client id that is shared for each partner.
totp	String	OTP code from the authenticator.

Headers

Name	Type	Description
Authorization	String	Bearer {Bearer Token Received in Transaction Initiation API}
Content-Type	String	application/x-www-form-urlencoded

200: OK

{
    "entity": {
        "accessToken": "eyJhbGciOiJSUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICJYbnNBNFVPdlkyU0JLSkdnX1ppTHN1Tk8tZ2dlLVB0RXZzX2twRTBhd3RnIn0.eyJleHAiOjE3MDM1Nzk0MTEsIm5iZiI6MTcwMzU3OTExMSwiaWF0IjoxNzAzNTc5MTExLCJhdXRoX3RpbWUiOjE3MDM1NzkxMTEsImp0aSI6IjI1YzY1YmE5LWIxMzYtNDY0My05ZWI5LTM0ZTg5NjM3ZmNiNSIsImlzcyI6Imh0dHBzOi8va2V5Y2xvYWsuYXV0aC1zdGFnZS52aWRhLmlkL3JlYWxtcy9zcHJpbmdib290LXF1aWNrc3RhcnQiLCJzdWIiOiIxMGQ3MTJhMi02NmIyLTQ5NzktOTJiYS1iMDlmMDRkMzAzYmQiLCJ0eXAiOiJCZWFyZXIiLCJhenAiOiJhcGkiLCJzZXNzaW9uX3N0YXRlIjoiZmJkNTRhYTctNzhkMy00MTJiLTk5NjEtNGRmZmRiMzNmNjhhIiwic2NvcGUiOiIiLCJzaWQiOiJmYmQ1NGFhNy03OGQzLTQxMmItOTk2MS00ZGZmZGIzM2Y2OGEiLCJzZXNzaW9uX2lkZW50aWZpZXIiOiJzdl9kaUdYV0diRSIsInR5cGUiOiJvdHAiLCJjcmVkZW50aWFsX2lkIjoiNjQ3MDc0NzMtNDdmZi00ZGFlLTk3N2QtMGUxNmVhYmMyMTUwIn0.M8FVS2nSPXXzLW4Qv64xQ0-EyxpuCkvot5-XunGIb_Vz86CCV5v3safTlvrwUBaGCA4AHPgUkvNTPj72TTsUJ0wJ8ZC5G5pUONw8WOV7BoFM0xv_zbDb8BCgoZxWbkzWRMsTGb9EfHuaUuHaL067nwvwLO1WPr1VZZPMBwPBBEnkCq3dTm0_qa-jg9OPdziMfbNUbNRJxxAcKNbO9qzUml8xr78L3nENx1h4picT0vT495-FydMVnMss0bqG7ErDiaYz-UuSA_0S45qghNW82g3c0Q8OHWBFdXbKUbN1TTJrXFpAV5_yN4NBh1XfIdKb3WGka4lhEE3uP3EmVR-hqw",
        "accessExpiresIn": 300,
        "refreshToken": "eyJhbGciOiJIUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICJmMjFhZGYyZS03NWU2LTQ5Y2UtOWYwZi00ZDEwNjE0MDA4NGEifQ.eyJleHAiOjE3MDM1ODA5MTEsImlhdCI6MTcwMzU3OTExMSwianRpIjoiMjQ0NTJkZGEtMzIzZC00MDczLTk2OWMtOTE5ZDgxMDAyZTU2IiwiaXNzIjoiaHR0cHM6Ly9rZXljbG9hay5hdXRoLXN0YWdlLnZpZGEuaWQvcmVhbG1zL3NwcmluZ2Jvb3QtcXVpY2tzdGFydCIsImF1ZCI6Imh0dHBzOi8va2V5Y2xvYWsuYXV0aC1zdGFnZS52aWRhLmlkL3JlYWxtcy9zcHJpbmdib290LXF1aWNrc3RhcnQiLCJzdWIiOiIxMGQ3MTJhMi02NmIyLTQ5NzktOTJiYS1iMDlmMDRkMzAzYmQiLCJ0eXAiOiJSZWZyZXNoIiwiYXpwIjoiYXBpIiwic2Vzc2lvbl9zdGF0ZSI6ImZiZDU0YWE3LTc4ZDMtNDEyYi05OTYxLTRkZmZkYjMzZjY4YSIsInNjb3BlIjoiIiwic2lkIjoiZmJkNTRhYTctNzhkMy00MTJiLTk5NjEtNGRmZmRiMzNmNjhhIn0.y0P805JRFzCb1YeDzytRqBwL1VY8SIAo0kYzV0QAWjA",
        "refreshExpiresIn": 1800,
        "authType": "otp"
    },
    "uri": "https://{environment-url}/realms/{partner-id}/protocol/api/authenticate",
    "bearerToken": "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJmYmQ1NGFhNy03OGQzLTQxMmItOTk2MS00ZGZmZGIzM2Y2OGEiLCJleGVjdXRpb24iOm51bGwsInRhYl9pZCI6InN2X2RpR1hXR2JFIiwibmJmIjoxNzAzNTc5MTExLCJzZXNzaW9uX2NvZGUiOiJWUTl0bzJtcFlTanBqNmY3YWtvSmNWVF9QV25PdjM3M2dVcVpPQk1teGRJIiwic2Vzc2lvbl9pZGVudGlmaWVyIjoic3ZfZGlHWFdHYkUiLCJleHAiOjE3MDM1Nzk0MTEsImlhdCI6MTcwMzU3OTExMSwiYXV0aF9zZXNzaW9uX2lkIjoiZmJkNTRhYTctNzhkMy00MTJiLTk5NjEtNGRmZmRiMzNmNjhhIiwianRpIjoiYmUyMTRkYjAtNDQ3NS00NDc3LWIzNDYtYjYzZTQ2YzEzZDk5In0.xrb46Ab2b35xKe7m4sR7e3PALS3kqjSTfh0VyyOrUpo",
    "authType": "otp"
}

Curl

curl --location --request GET 'https://{environment-url}/realms/{partner-id}/protocol/api/init?type=otp&client_id=api&client_secret=enESfot4PPpSWxTa74vR8D9nrW4UTtT3'

Python

import requests

url = "https://{environment-url}/realms/{partner-id}/protocol/api/init?type=otp&client_id=api&client_secret=enESfot4PPpSWxTa74vR8D9nrW4UTtT3"

payload={}
headers = {}

response = requests.request("GET", url, headers=headers, data=payload)

print(response.text)

NodeJS

var axios = require('axios');

var config = {
  method: 'get',
  url: 'https://{environment-url}/realms/{partner-id}/protocol/api/init?type=otp&client_id=api&client_secret=enESfot4PPpSWxTa74vR8D9nrW4UTtT3',
  headers: { }
};

axios(config)
.then(function (response) {
  console.log(JSON.stringify(response.data));
})
.catch(function (error) {
  console.log(error);
});

Java

OkHttpClient client = new OkHttpClient().newBuilder()
  .build();
MediaType mediaType = MediaType.parse("text/plain");
RequestBody body = RequestBody.create(mediaType, "");
Request request = new Request.Builder()
  .url("https://{environment-url}/realms/{partner-id}/protocol/api/init?type=FaceMatch&client_id=api&client_secret=enESfot4PPpSWxTa74vR8D9nrW4UTtT3")
  .method("GET", body)
  .build();
Response response = client.newCall(request).execute();

C#

var client = new RestClient("https://{environment-url}/realms/{partner-id}/protocol/api/init?type=otp&client_id=api&client_secret=enESfot4PPpSWxTa74vR8D9nrW4UTtT3");
client.Timeout = -1;
var request = new RestRequest(Method.GET);
IRestResponse response = client.Execute(request);
Console.WriteLine(response.Content);

PHP

<?php

$curl = curl_init();

curl_setopt_array($curl, array(
  CURLOPT_URL => 'https://{environment-url}/realms/{partner-id}/protocol/api/init?type=otp&client_id=api&client_secret=enESfot4PPpSWxTa74vR8D9nrW4UTtT3',
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => '',
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 0,
  CURLOPT_FOLLOWLOCATION => true,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => 'GET',
));

$response = curl_exec($curl);

curl_close($curl);
echo $response;

Success Response

{
    "entity": {
        "accessToken": "eyJhbGciOiJSUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICJYbnNBNFVPdlkyU0JLSkdnX1ppTHN1Tk8tZ2dlLVB0RXZzX2twRTBhd3RnIn0.eyJleHAiOjE3MDM1Nzk0MTEsIm5iZiI6MTcwMzU3OTExMSwiaWF0IjoxNzAzNTc5MTExLCJhdXRoX3RpbWUiOjE3MDM1NzkxMTEsImp0aSI6IjI1YzY1YmE5LWIxMzYtNDY0My05ZWI5LTM0ZTg5NjM3ZmNiNSIsImlzcyI6Imh0dHBzOi8va2V5Y2xvYWsuYXV0aC1zdGFnZS52aWRhLmlkL3JlYWxtcy9zcHJpbmdib290LXF1aWNrc3RhcnQiLCJzdWIiOiIxMGQ3MTJhMi02NmIyLTQ5NzktOTJiYS1iMDlmMDRkMzAzYmQiLCJ0eXAiOiJCZWFyZXIiLCJhenAiOiJhcGkiLCJzZXNzaW9uX3N0YXRlIjoiZmJkNTRhYTctNzhkMy00MTJiLTk5NjEtNGRmZmRiMzNmNjhhIiwic2NvcGUiOiIiLCJzaWQiOiJmYmQ1NGFhNy03OGQzLTQxMmItOTk2MS00ZGZmZGIzM2Y2OGEiLCJzZXNzaW9uX2lkZW50aWZpZXIiOiJzdl9kaUdYV0diRSIsInR5cGUiOiJvdHAiLCJjcmVkZW50aWFsX2lkIjoiNjQ3MDc0NzMtNDdmZi00ZGFlLTk3N2QtMGUxNmVhYmMyMTUwIn0.M8FVS2nSPXXzLW4Qv64xQ0-EyxpuCkvot5-XunGIb_Vz86CCV5v3safTlvrwUBaGCA4AHPgUkvNTPj72TTsUJ0wJ8ZC5G5pUONw8WOV7BoFM0xv_zbDb8BCgoZxWbkzWRMsTGb9EfHuaUuHaL067nwvwLO1WPr1VZZPMBwPBBEnkCq3dTm0_qa-jg9OPdziMfbNUbNRJxxAcKNbO9qzUml8xr78L3nENx1h4picT0vT495-FydMVnMss0bqG7ErDiaYz-UuSA_0S45qghNW82g3c0Q8OHWBFdXbKUbN1TTJrXFpAV5_yN4NBh1XfIdKb3WGka4lhEE3uP3EmVR-hqw",
        "accessExpiresIn": 300,
        "refreshToken": "eyJhbGciOiJIUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICJmMjFhZGYyZS03NWU2LTQ5Y2UtOWYwZi00ZDEwNjE0MDA4NGEifQ.eyJleHAiOjE3MDM1ODA5MTEsImlhdCI6MTcwMzU3OTExMSwianRpIjoiMjQ0NTJkZGEtMzIzZC00MDczLTk2OWMtOTE5ZDgxMDAyZTU2IiwiaXNzIjoiaHR0cHM6Ly9rZXljbG9hay5hdXRoLXN0YWdlLnZpZGEuaWQvcmVhbG1zL3NwcmluZ2Jvb3QtcXVpY2tzdGFydCIsImF1ZCI6Imh0dHBzOi8va2V5Y2xvYWsuYXV0aC1zdGFnZS52aWRhLmlkL3JlYWxtcy9zcHJpbmdib290LXF1aWNrc3RhcnQiLCJzdWIiOiIxMGQ3MTJhMi02NmIyLTQ5NzktOTJiYS1iMDlmMDRkMzAzYmQiLCJ0eXAiOiJSZWZyZXNoIiwiYXpwIjoiYXBpIiwic2Vzc2lvbl9zdGF0ZSI6ImZiZDU0YWE3LTc4ZDMtNDEyYi05OTYxLTRkZmZkYjMzZjY4YSIsInNjb3BlIjoiIiwic2lkIjoiZmJkNTRhYTctNzhkMy00MTJiLTk5NjEtNGRmZmRiMzNmNjhhIn0.y0P805JRFzCb1YeDzytRqBwL1VY8SIAo0kYzV0QAWjA",
        "refreshExpiresIn": 1800,
        "authType": "otp"
    },
    "uri": "https://{environment-url}/realms/{partner-id}/protocol/api/authenticate",
    "bearerToken": "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJmYmQ1NGFhNy03OGQzLTQxMmItOTk2MS00ZGZmZGIzM2Y2OGEiLCJleGVjdXRpb24iOm51bGwsInRhYl9pZCI6InN2X2RpR1hXR2JFIiwibmJmIjoxNzAzNTc5MTExLCJzZXNzaW9uX2NvZGUiOiJWUTl0bzJtcFlTanBqNmY3YWtvSmNWVF9QV25PdjM3M2dVcVpPQk1teGRJIiwic2Vzc2lvbl9pZGVudGlmaWVyIjoic3ZfZGlHWFdHYkUiLCJleHAiOjE3MDM1Nzk0MTEsImlhdCI6MTcwMzU3OTExMSwiYXV0aF9zZXNzaW9uX2lkIjoiZmJkNTRhYTctNzhkMy00MTJiLTk5NjEtNGRmZmRiMzNmNjhhIiwianRpIjoiYmUyMTRkYjAtNDQ3NS00NDc3LWIzNDYtYjYzZTQ2YzEzZDk5In0.xrb46Ab2b35xKe7m4sR7e3PALS3kqjSTfh0VyyOrUpo",
    "authType": "otp"
}

Error Response

{
    "error": "invalid_request",
    "errorDescription": "Invalid or expired bearer token"
}

Response Schema

{
    "error": "{TYPE OF ERROR}",
    "errorDescription": "{REASONING FOR THE ERROR}"
}

For a complete list of error codes and their meanings, refer to the Error Scenarios section.