Get started

Authentication

The gateway uses a Bearer token issued by login. The same token is forwarded to every upstream service.

Bearer token

Call POST /api/v1/login with a company account. Read data.access_token and send it on protected routes:

Authorization: Bearer 1|abcdefghijklmnopqrstuvwxyz

There is no gateway API key, HMAC, or OAuth client-credentials flow. Social login is available as POST /api/v1/social-auth if the user already has a Google or Facebook access token.

Company roles

Only admin (company administrator) and user (employee) may use this API. The gateway checks the role at login and again on every protected request.

Fine-grained permissions (workflow roles, EDM ACLs, and so on) are enforced by upstream services. The gateway only applies this binary company-user gate.

Public routes

These paths do not require a Bearer token:

• Login, social login, password reset, login MFA, email verification
• GET /api/v1/certificates/{certificate}/download
• GET /api/v4/documents/{uuid}/download
• GET /api/v4/verify/{uuid}
• GET /api/v4/attachments/{att_uuid}/download

Everything else requires a valid company-user token.

MFA

Login can return a challenge instead of a token. Complete it with the login MFA endpoints (/api/v1/login/mfa/...), then enroll extra factors on the authenticated MFA routes (/api/v1/mfa/...) — email, TOTP, or WebAuthn.

Headers