Authentication

Access to the API is secured. You must first authenticate to obtain a token, which is required for any use of the API.

The token provided by the API must be sent in the header of every request, in the x-carmoove-token field. The Content-type field must also be sent in the header.

Obtaining a token

POST /v1/login
Content-type: application/json

{
  "appId": "your-app-id",
  "appKey": "your-app-key"
}

Parameters

Field	Type	Description
appId	String	Application ID, provided by Carmoove.
appKey	String	Authentication key, provided by Carmoove.

Response

Field	Type	Description
token	String	Authentication token, to be provided in the x-carmoove-token header.
until	Timestamp	Date and time the token expires.
refresh_token	String	Token used to renew the token without re-authenticating (see Refreshing a token).
refresh_until	Timestamp	Date and time the refresh_token expires.
update_password	Bool	true if the account password must be changed.

Refreshing a token

Obtains a new token without re-authenticating with appId/appKey, using the refresh_token obtained at login.

POST /v1/refreshToken
Content-type: application/json

{
  "appId": "your-app-id",
  "appKey": "your-app-key",
  "refreshToken": "your-refresh-token"
}

Parameters

Field	Type	Description
appId	String	Application ID, provided by Carmoove.
appKey	String	Authentication key, provided by Carmoove.
refreshToken	String	Refresh token obtained at login.

Response

Field	Type	Description
token	String	New authentication token.
until	Timestamp	Date and time the token expires.

Using the token

Every request to another API endpoint must include the token obtained, as well as the content type:

GET /v1/vehicles
x-carmoove-token: eyJhbGciOiJSUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICJ2LXVSeWFuNUFCaE9NSXFaU0tjWG1STURrRHFx...
Content-type: application/json