Exchange IDP Code for Tokens

Exchanges a one-time code (received from the IDP callback redirect) for access and refresh tokens.

After the IDP callback flow completes, GIS redirects to the client's redirect_uri with a code parameter. The client then calls this endpoint to exchange that code for tokens.

Flow:

After IDP authentication, client receives redirect_uri?code=<one_time_code>
Client calls POST /api2/idp/token with the code and client ID
GIS validates the code, resolves the guest identity, and issues tokens

The one-time code expires after a short period (typically 60 seconds) and can only be used once.

Headers

X-Correlation-Id
Type: string

Optional caller-provided correlation ID; echoed in responses when present.
Accept
Type: string
required

Advertises which content types the client is able to understand
Content-Type
Type: string
required

Set this header to application/json

Body·

required

application/json

Request body containing the one-time code and client identifier.

client
Type: string
required

OAuth client ID provided by the business and configured with the Advance Auth scope. Required to identify the client application for authentication.
code
Type: string
required

One-time code received from the IDP callback redirect. Expires after approximately 60 seconds and can only be used once.

Responses

application/json
application/json
application/json
application/json
application/json
application/json
application/json
application/json
application/json

post/api2/idp/token

curl https://SERVER_NAME_GOES_HERE/api2/idp/token \
  --request POST \
  --header 'Accept: application/json' \
  --header 'Content-Type: application/json' \
  --data '{
  "client": "",
  "code": ""
}'

Show Schema

{
  "data": {
    "access_token": "ACCESS_TOKEN_GOES_HERE",
    "refresh_token": "REFRESH_TOKEN_GOES_HERE",
    "expires_in": 86400,
    "token_type": "Bearer"
  }
}

Successfully exchanged code for tokens.