The Guide

Authorising your OKAPI requests

To be authenticated a request to OKAPI should carry an access token in its headers.

Request an Access token

POST
https://api.productdata.volkswagenag.com/oauth2/token?grant_type=client_credentials&client_id={client_id}&client_secret={client_secret}
Content-Type application/x-www-form-urlencoded

To obtain access to the OKAPI HTTP service we use the OAuth2 client credentials grant to provide an access_token.
The access_token provides access to the OKAPI services. It expires after one hour.
Please ensure that your backend application handles the lifecycle of the access token. More information about access_tokens can be found in the official OAuth spec: https://tools.ietf.org/html/rfc6749#section-1.4.

To request the access_token you have to provide the client_id and your client_secret.

You will need the access_token for every subsequent request to okapi. It will expire after one hour.

Toggle arrow Example Request with cURL

Request
curl \
-H "Cache-Control: no-cache" \
-H "Content-Type: application/x-www-form-urlencoded" \
-d "grant_type=client_credentials" \
-d "client_id=<client_id>" \
-d "client_secret=<client_secret>" \
-X POST https://api.productdata.volkswagenag.com/oauth2/token
Response
HTTP/1.1 200 OK
Content-Type: application/json;charset=UTF-8

{
"access_token":"<access_token>",
"token_type":"bearer",
"expires_in":3600,
"user_id":"<client_id>"
}

Adding token to the request

To authorise the request the access token should be added to the header with the key "Authorization". The value should be the access prefixed with the marker "Bearer".

GET
https://api.productdata.volkswagenag.com/v3/countries
Authorization Bearer {access_token}
Accept application/json

Toggle arrow Example Request with cURL

Request
curl \
-X GET https://api.productdata.volkswagenag.com/v3/countries \
-H "Authorization: bearer <access_token>" \
-H "Accept: application/json"