This documentation is currently under development. Certain sections are not yet complete and will be added shortly.
Ctrlk
HomeDocumentationRessources
For the complete documentation index, see llms.txt. This page is also available as Markdown.

Security

Generate JWT tokens from custom claims

post
/api/{tenantId}/tokens/generate

Creates one or more JWT tokens with custom claims for advanced authentication scenarios.

Use Cases

  • Testing and development

  • Service-to-service authentication

  • Custom identity workflows

  • Token migration scenarios

Authorization

Requires AuthenticationToken.Write scope - restricted to authorized administrators and services.

Validity Duration

  • Default: 10 years (3650.00:00:00.000)

  • Configurable via query parameter in TimeSpan format

  • Examples: 1.00:00:00 (1 day), 30.00:00:00 (30 days)

Request Format

Accepts an array of claim sets, where each set generates one token: [[{"type": "sub", "value": "user123"}, {"type": "email", "value": "[email protected]"}]]

Security Warning

Generated tokens have full authentication authority. Protect endpoint access and token distribution carefully.

Required scopes
This endpoint requires the following scopes:
Authorizations
OAuth2implicitRequired
Authorization URL:
Path parameters
tenantIdstringRequired
Query parameters
validityDurationstringOptional

Optional validity duration in TimeSpan format (e.g., "1.00:00:00" for 1 day). Default is 10 years

Bodyobject · WebClaim[][]
typestringOptional

claim type

valuestringOptional

Value

valueTypestring · nullableOptional

optional value type

Responses
200

Tokens generated successfully.

string[]Optional
post/api/{tenantId}/tokens/generate
POST /api/{tenantId}/tokens/generate HTTP/1.1
Host: app.neostore.cloud
Authorization: Bearer YOUR_OAUTH2_TOKEN
Content-Type: application/json
Accept: */*
Content-Length: 51

[
  [
    {
      "type": "text",
      "value": "text",
      "valueType": null
    }
  ]
]
[
  "text"
]

Get the check-in policy

get
/api/{tenantId}/admin/security/checkinPolicy

Returns the checkInSecurityMode of security.yml. A tenant whose file does not carry one gets full, the policy the runtime applies in that case.

Authorization

Requires tenant.configuration.enrolment:read scope.

Required scopes
This endpoint requires the following scopes:
Authorizations
OAuth2implicitRequired
Authorization URL:
Path parameters
tenantIdstringRequired
Responses
200

Check-in policy returned.

Check-in policy currently applied by this tenant.

modestring · enumRequired

Policy stored in security.yml. full when the file does not carry one, which is what the runtime applies in that case.

Possible values:
get/api/{tenantId}/admin/security/checkinPolicy
GET /api/{tenantId}/admin/security/checkinPolicy HTTP/1.1
Host: app.neostore.cloud
Authorization: Bearer YOUR_OAUTH2_TOKEN
Accept: */*

{
  "mode": "noIdentification"
}

Configure the check-in policy

put
/api/{tenantId}/admin/security/checkinPolicy

Replaces the checkInSecurityMode of security.yml. Every other section of the file, the general secrets included, is written back unchanged.

Authorization

Requires tenant.configuration.enrolment:write scope.

Required scopes
This endpoint requires the following scopes:
Authorizations
OAuth2implicitRequired
Authorization URL:
Path parameters
tenantIdstringRequired
Body

Request body to configure the check-in policy.

modestring · enumRequired

Identification required from a customer collecting a pass.

Possible values:
Responses
400

The policy is not one of the supported values.

or
put/api/{tenantId}/admin/security/checkinPolicy
PUT /api/{tenantId}/admin/security/checkinPolicy HTTP/1.1
Host: app.neostore.cloud
Authorization: Bearer YOUR_OAUTH2_TOKEN
Content-Type: application/json
Accept: */*
Content-Length: 27

{
  "mode": "noIdentification"
}
{
  "type": null,
  "title": null,
  "status": null,
  "detail": null,
  "instance": null,
  "ANY_ADDITIONAL_PROPERTY": "anything"
}

Get the general secrets

get
/api/{tenantId}/admin/security/secrets

Returns secret1 and secret2 of security.yml in clear — they are the values an integrator signs externalIdentifier HMACs with, so there is nothing useful to return redacted.

Authorization

Requires tenant.generalSecret:read scope.

Required scopes
This endpoint requires the following scopes:
Authorizations
OAuth2implicitRequired
Authorization URL:
Path parameters
tenantIdstringRequired
Responses
200

General secrets returned.

General secrets of the tenant.

secret1string · nullableOptional

First secret used for signing. Null when the tenant has none configured yet.

secret2string · nullableOptional

Second secret used for signing. Null when the tenant has none configured yet.

get/api/{tenantId}/admin/security/secrets
GET /api/{tenantId}/admin/security/secrets HTTP/1.1
Host: app.neostore.cloud
Authorization: Bearer YOUR_OAUTH2_TOKEN
Accept: */*

{
  "secret1": null,
  "secret2": null
}

Configure the general secrets

put
/api/{tenantId}/admin/security/secrets

Replaces secret1 and secret2 of security.yml. Every other section of the file, the check-in policy included, is written back unchanged.

Rotating a secret invalidates every link already signed with it. Both values are replaced on every call, so send back the current value of the one you do not mean to change.

Authorization

Requires tenant.generalSecret:write scope.

Required scopes
This endpoint requires the following scopes:
Authorizations
OAuth2implicitRequired
Authorization URL:
Path parameters
tenantIdstringRequired
Body

Request body to configure the general secrets. Both values are replaced.

secret1string · min: 1Required

First secret used for signing.

secret2string · min: 1Required

Second secret used for signing.

Responses
400

One of the secrets is empty.

or
put/api/{tenantId}/admin/security/secrets
PUT /api/{tenantId}/admin/security/secrets HTTP/1.1
Host: app.neostore.cloud
Authorization: Bearer YOUR_OAUTH2_TOKEN
Content-Type: application/json
Accept: */*
Content-Length: 35

{
  "secret1": "text",
  "secret2": "text"
}
{
  "type": null,
  "title": null,
  "status": null,
  "detail": null,
  "instance": null,
  "ANY_ADDITIONAL_PROPERTY": "anything"
}

Last updated