Authentication

The API uses OpenID Connect authentication via a separate Identity Server instance. The client credentials flow is the preferred method of obtaining a token to be able to call the Web API.

To get a token, perform a POST request to https://identityserver.aareoncloud.nl/connect/token with the following form data:

Key	Value
scope	Treasury
client_id	<Client ID you received from us>
client_secret	<Client secret you received from us>
grant_type	client_credentials

An example request using curl would look like:

curl -X POST https://identityserver.aareoncloud.nl/connect/token -d  'scope=Treasury&client\_id=TreasuryTestAPI&client\_secret=ba77a44a-bbf4-0856-7d10-a2a20ffce916&grant\_type=client\_credentials'

The result will be a JSON object containing the access token and a expiry time.

{"access\_token":"eyJhbGciOiJSUzI1NiIsImtpZCI6IjM0OTRFOTdBNDI0Rjg1MzFCODJDRENFN0REMzQ5NjFFNjI0Nzc5QjYiLCJ0eXAiOiJKV1QiLCJ4NXQiOiJOSlRwZWtKUGhURzRMTnpuM1RTV0htSkhlYlkifQ.eyJuYmYiOjE1OTk3NDI4NzQsImV4cCI6MTU5OTc0NjQ3NCwiaXNzIjoiaHR0cHM6Ly9pZGVudGl0eXNlcnZlci1wcm9kdWN0aW9uLmFhcmVvbmNsb3VkLm5sIiwiYXVkIjpbImh0dHBzOi8vaWRlbnRpdHlzZXJ2ZXItcHJvZHVjdGlvbi5hYXJlb25jbG91ZC5ubC9yZXNvdXJjZXMiLCJUcmVhc3VyeSJdLCJjbGllbnRfaWQiOiJUcmVhc3VyeUFQSSIsImN1c3QiOiJ1cm46YWFyZW9uLm5sL21hcmthcmlhbi9pZGVudGlmaWVycy9jdXN0b21lci1uYW1lL2FkZnMyMDE2YWFyZW9ubmwiLCJkb21haW5fYWNjb3VudF9uYW1lIjoiQWFyZW9uLmNvbVxcVHJlYXN1cnkiLCJzY29wZSI6WyJUcmVhc3VyeSJdfQ.dvnQfZB9ht-35FVexDCHesumhpsyF6TSJ3HvDCnogP1c3zMbON0gz\_QzmuUpZjbLIHj8ANsoDZ08MZgKxNWBAUZIoffeHb6va6-GCKghRyQTC59wLqE2rqCSBqOWWK1pilRUL9sLgZZIpn45gVnHPtcO0Gv6AYnWe9nb\_BNabSfKrNeeBl\_rIhnq39iIJoGty6lcm-5yz8UchB8VECpoETYpnzGxjjXf0KcHtUMeN7z5DTLrprqHaIsG3oNfw4BhAc14elj1a-C9ONXpvYA4mRJKx0E5I0P4MQBzH8qiyAsbkLNL4Uqz1ap-Ndph5zb5Z9yHlDjL\_UdZdXINBQzlAB","expires\_in":3600,"token\_type":"Bearer"}

When calling the Treasury API, specify the access_token as a Bearer token in the Authorization header:

Authorization: Bearer eyJhbG……

Before you can call the API, ensure a service account has been created in the Assets & Treasury application with the correct permissions.