OAuth2 API

Snyk은 Snyk Apps와 주로 사용하기 위한 OAuth2 API를 제공합니다. 이는 RFC 6749를 준수합니다.

대부분의 엔드포인트는 Snyk API 서브도메인에서 제공됩니다(예: https://api.snyk.io), 하나의 예외는 /oauth2/authorize이며 이는 주요 앱 서브도메인에서 제공됩니다(예: https://app.snyk.io).

Initiate the authorization code flow

get

To be called by the end user to authorize the client application to their Snyk organizations. Success returns a redirect to the provided redirect_uri, containing an authorization code which can be exchanged for an access token.

Query parameters
response_typestring · enumRequired

The type of authorization flow being used. Only "code" is supported for authorization code flow.

Example: codePossible values:
client_idstringRequired

The client ID of the client application.

Example: 64ae3415-5ccd-49e5-91f0-9101a6793ec2
redirect_uristringRequired

The redirection URI to which the authorization server will redirect the user after granting or denying authorization. Must match one of the URIs set on the client application exactly.

Example: https://example.com/callback
statestringOptional

An opaque value used by the client to maintain state between the authorization request and the authorization callback. Use this value to match client callbacks to the request that spawned them.

Example: random_state_value
code_challengestringRequired

A cryptographically secure code challenge derived from a secret code verifier you generate on the client-side as defined in [RFC7636]. It is generated from a hashing a randomly generated string, the code_verifier used when exchanging tokens, then URL safe base 64 encoding the result.

Example: YWVjMDcwNjQ1ZmU1M2VlM2IzNzYzMDU5Mzc2MTM0ZjA1OGNjMzM3MjQ3Yzk3OGFkZDE3OGI2Y2NkZmIwMDE5Zg
code_challenge_methodstring · enumRequired

The method used to derive the code challenge from the code verifier, only S256 is supported.

Example: S256Possible values:
Responses
303

Redirection to authorization server. The Location header is set to the provided redirect_uri so the user's browser should follow this redirect automatically.

get
GET /oauth2/authorize HTTP/1.1
Host: app.snyk.io
Accept: */*
303

Redirection to authorization server. The Location header is set to the provided redirect_uri so the user's browser should follow this redirect automatically.

No content

Request an access token

post

Allows the client application to exchange the authorization code received from the authorization server for an access token.

Body
one ofOptional
or
or
Responses
200

Successful token request

application/json
post
POST /oauth2/token HTTP/1.1
Host: api.snyk.io
Content-Type: application/x-www-form-urlencoded
Accept: */*
Content-Length: 203

"grant_type='authorization_code'&code='returned_auth_code'&client_id='64ae3415-5ccd-49e5-91f0-9101a6793ec2'&client_secret='super_secret_client_secret'&code_verifier='your_secure_code_verifier'"
{
  "access_token": "some_opaque_access_token_string",
  "expires_in": 3599,
  "refresh_token": "some_opaque_refresh_token_string",
  "refresh_expires_in": 15552000,
  "token_type": "bearer",
  "scope": "org.read org.project.read org.project.snapshot.read",
  "bot_id": "95233fa3-33cf-4dd3-a6ac-e040985e1a4f"
}

Revoke refresh token

post

Revokes an otherwise valid refresh token so it can't be reused. This is used when a refresh token is accidentally, or maliciously, leaked.

Body
client_idstringRequired

The client ID of the client application.

Example: 64ae3415-5ccd-49e5-91f0-9101a6793ec2
client_secretstringRequired

The client secret of the client application.

Example: super_secret_client_secret
tokenstringRequired

The refresh token to be revoked.

Example: some_opaque_refresh_token_string
Responses
200

The token has been revoked, or was invalid.

No content
post
POST /oauth2/revoke HTTP/1.1
Host: api.snyk.io
Content-Type: application/x-www-form-urlencoded
Accept: */*
Content-Length: 140

"client_id='64ae3415-5ccd-49e5-91f0-9101a6793ec2'&client_secret='super_secret_client_secret'&token='some_opaque_refresh_token_string'"
No content
PreviousV1 APINextReference

Last updated