> ## Documentation Index
> Fetch the complete documentation index at: https://developers.resistant.ai/llms.txt
> Use this file to discover all available pages before exploring further.
# Create token [ap-3]
> This endpoint returns access tokens, ID tokens, and refresh tokens depending on the request parameters. For [password](https://developer.okta.com/docs/guides/implement-grant-type/ropassword/main/), [client credentials](https://developer.okta.com/docs/guides/implement-grant-type/clientcreds/main/), [SAML 2.0 assertion](https://developer.okta.com/docs/guides/implement-grant-type/saml2assert/main/), and [refresh token](https://developer.okta.com/docs/guides/refresh-tokens/main/) flows, calling `/token` is the only step of the flow. For the [authorization code](https://developer.okta.com/docs/guides/implement-grant-type/authcode/main/) flow, calling `/token` is the second step of the flow.
> **Note:** The `/token` endpoint requires client authentication. The method is configured per client app. See [Client authentication methods](/openapi/okta-oauth/guides/client-auth/).
## OpenAPI
````yaml /spec-ap-3.json post /token
openapi: 3.0.1
info:
title: Resistant Documents API
version: 2.0.0b
description: >-
Resistant Documents provides this API to programmatically interact with its
document analysis engine.
Interaction with the API can be divided into three phases:
1. Creating document submission
2. Uploading a file for for analysis to an address returned from step 1.
3. Fetching analysis results
In the first step, the submission is created by posting to the
`/v2/submission` endpoint. The response contains a `submission_id` uniquely
identifying the document to be analyzed throughout the entire interaction,
and is used to fetch analysis results later.
Submission response also returns `upload_url` containing a pre-signed URL.
This URL should be used to upload the actual document to be analyzed in the
second step. Please note the document has to be uploaded using HTTP `PUT`
method with `Content-Type` HTTP header set to `application/octet-stream`.
In the last step, client should repeatedly poll using the
`/v2/submission/{submission_id}/fraud` endpoint for analysis results. The
best practice is to use polling with an [exponential
back-off](https://en.wikipedia.org/wiki/Exponential_backoff) to reduce load
on the API.
# Authentication
servers:
- url: https://api.ap-3.documents.resistant.ai
security: []
paths:
/token:
post:
summary: Create token [ap-3]
description: >-
This endpoint returns access tokens, ID tokens, and refresh tokens
depending on the request parameters. For
[password](https://developer.okta.com/docs/guides/implement-grant-type/ropassword/main/),
[client
credentials](https://developer.okta.com/docs/guides/implement-grant-type/clientcreds/main/),
[SAML 2.0
assertion](https://developer.okta.com/docs/guides/implement-grant-type/saml2assert/main/),
and [refresh
token](https://developer.okta.com/docs/guides/refresh-tokens/main/)
flows, calling `/token` is the only step of the flow. For the
[authorization
code](https://developer.okta.com/docs/guides/implement-grant-type/authcode/main/)
flow, calling `/token` is the second step of the flow.
> **Note:** The `/token` endpoint requires client authentication. The
method is configured per client app. See [Client authentication
methods](/openapi/okta-oauth/guides/client-auth/).
operationId: token
requestBody:
content:
application/x-www-form-urlencoded:
schema:
$ref: '#/components/schemas/TokenRequest'
responses:
'200':
description: >-
Based on the scopes requested. The scopes specified in a request are
included in the access token in the response.
content:
application/json:
schema:
$ref: '#/components/schemas/TokenResponse'
'400':
description: Bad Request
content:
application/json:
schema:
$ref: '#/components/schemas/OAuthError'
'401':
description: Unauthorized
content:
application/json:
schema:
$ref: '#/components/schemas/OAuthError'
'403':
description: Forbidden
content:
application/json:
schema:
$ref: '#/components/schemas/OAuthError'
'429':
description: Too Many Requests
content:
application/json:
schema:
$ref: '#/components/schemas/429Error'
security:
- client_authentication_client_secret_basic: []
servers:
- url: https://eu.id.resistant.ai/oauth2/ausp40dse1Q0rzDq6417/v1
components:
schemas:
TokenRequest:
type: object
properties:
grant_type:
$ref: '#/components/schemas/GrantType'
scope:
type: string
description: The scopes requested
TokenResponse:
type: object
properties:
access_token:
type: string
description: An access token
device_secret:
type: string
description: >-
An opaque device secret. This is returned if the `device_sso` scope
is granted.
expires_in:
type: integer
description: The expiration time of the access token in seconds
id_token:
type: string
description: An ID token. This is returned if the `openid` scope is granted.
refresh_token:
type: string
description: >-
An opaque refresh token. This is returned if the `offline_access`
scope is granted.
scope:
type: string
description: The scopes contained in the access token
token_type:
$ref: '#/components/schemas/TokenResponseTokenType'
OAuthError:
title: OAtuhError
type: object
properties:
error:
type: string
description: >-
An error code defined in
[RFC6749](https://datatracker.ietf.org/doc/html/rfc6749#section-5.2)
or other extension
error_description:
type: string
description: >-
A short description of what caused this error. Sometimes this
contains dynamically-generated information about your specific
error.
429Error:
title: Error
type: object
properties:
errorCauses:
type: array
items:
type: object
properties:
errorSummary:
type: string
errorCode:
type: string
description: An Okta code for this type of error
errorId:
type: string
description: >-
A unique identifier for this error. Okta Support can use this to
help with troubleshooting.
errorLink:
type: string
description: An Okta code for this type of error
errorSummary:
type: string
description: >-
A short description of what caused this error. Sometimes this
contains dynamically-generated information about your specific
error.
GrantType:
description: >-
Determines the mechanism Okta uses to authorize the creation of the
tokens
type: string
enum:
- client_credentials
TokenResponseTokenType:
description: >-
The token type in a `/token` response. The value is generally `Bearer`
except for a few instances of token exchange.
type: string
enum:
- Bearer
securitySchemes:
client_authentication_client_secret_basic:
type: http
scheme: basic
description: >-
Pass the client credentials concatenated with a `:` and base64-encoded
as part of the Authorization header prefixed with `Basic`
```
Authorization: Basic {base64(:)}
```
```
Authorization: Basic
MGpyYWJ5UVdtNEI5elZKUGJvdFk6NVc3WFVMQ0VzNEJKS25XVVh3aDhsZ21lWFJoY0djZFZpRnA4NHBXZQ==
```
````