API ReferenceAuth

Issue Access Token

Issues a short-lived access token from the authenticated API key. Access tokens can optionally be bound to a specific employer or employee for scoped access. Tokens expire after 15 minutes.

Authentication

AuthorizationBearer

API Key or Access Token authentication using Bearer token in Authorization header. API keys use the vit_apk_ prefix, access tokens use the vit_at_ prefix.

Request

This endpoint expects an object.
grant_typeenumRequired

Token issuance flow. Currently only ‘client_credentials’ supported.

  • client_credentials - client_credentials
bound_entityobject or nullOptional
Optional entity to bind the token to for scoped access

Response headers

X-RateLimit-Limitinteger
Maximum number of requests allowed within the rate limit window
X-RateLimit-Remaininginteger
Number of requests remaining in the current rate limit window
X-RateLimit-Resetinteger

Unix timestamp (seconds) when the rate limit window resets

Response

access_tokenstring

The issued access token (vit_at_*)

token_typestring
Token type, always 'Bearer'
expires_ininteger
Token lifetime in seconds
bound_entityobject or nullOptional
Entity the token is bound to, if any

Errors

400
Bad Request Error
401
Unauthorized Error
403
Forbidden Error
404
Not Found Error
409
Conflict Error
429
Too Many Requests Error
500
Internal Server Error
502
Bad Gateway Error