Security
Creates one or more JWT tokens with custom claims for advanced authentication scenarios.
Use Cases
Testing and development
Service-to-service authentication
Custom identity workflows
Token migration scenarios
Authorization
Requires AuthenticationToken.Write scope - restricted to authorized administrators and services.
Validity Duration
Default: 10 years (3650.00:00:00.000)
Configurable via query parameter in TimeSpan format
Examples: 1.00:00:00 (1 day), 30.00:00:00 (30 days)
Request Format
Accepts an array of claim sets, where each set generates one token: [[{"type": "sub", "value": "user123"}, {"type": "email", "value": "[email protected]"}]]
Security Warning
Generated tokens have full authentication authority. Protect endpoint access and token distribution carefully.
Optional validity duration in TimeSpan format (e.g., "1.00:00:00" for 1 day). Default is 10 years
claim type
Value
optional value type
Tokens generated successfully.
Caller not authenticated.
Caller lacks AuthenticationToken.Write scope.
Unexpected server error.
POST /api/{tenantId}/tokens/generate HTTP/1.1
Host: app.neostore.cloud
Authorization: Bearer YOUR_OAUTH2_TOKEN
Content-Type: application/json
Accept: */*
Content-Length: 51
[
[
{
"type": "text",
"value": "text",
"valueType": null
}
]
][
"text"
]Check-in policy returned.
Check-in policy currently applied by this tenant.
Policy stored in security.yml. full when the file does not carry one, which is what
the runtime applies in that case.
The tenant has no readable security.yml.
GET /api/{tenantId}/admin/security/checkinPolicy HTTP/1.1
Host: app.neostore.cloud
Authorization: Bearer YOUR_OAUTH2_TOKEN
Accept: */*
{
"mode": "noIdentification"
}Request body to configure the check-in policy.
Identification required from a customer collecting a pass.
Check-in policy updated.
The policy is not one of the supported values.
The tenant has no readable security.yml.
PUT /api/{tenantId}/admin/security/checkinPolicy HTTP/1.1
Host: app.neostore.cloud
Authorization: Bearer YOUR_OAUTH2_TOKEN
Content-Type: application/json
Accept: */*
Content-Length: 27
{
"mode": "noIdentification"
}{
"type": null,
"title": null,
"status": null,
"detail": null,
"instance": null,
"ANY_ADDITIONAL_PROPERTY": "anything"
}General secrets returned.
General secrets of the tenant.
First secret used for signing. Null when the tenant has none configured yet.
Second secret used for signing. Null when the tenant has none configured yet.
The tenant has no readable security.yml.
GET /api/{tenantId}/admin/security/secrets HTTP/1.1
Host: app.neostore.cloud
Authorization: Bearer YOUR_OAUTH2_TOKEN
Accept: */*
{
"secret1": null,
"secret2": null
}Replaces secret1 and secret2 of security.yml. Every other section of the file, the check-in policy included, is written back unchanged.
Rotating a secret invalidates every link already signed with it. Both values are replaced on every call, so send back the current value of the one you do not mean to change.
Authorization
Requires tenant.generalSecret:write scope.
Request body to configure the general secrets. Both values are replaced.
First secret used for signing.
Second secret used for signing.
General secrets updated.
One of the secrets is empty.
The tenant has no readable security.yml.
PUT /api/{tenantId}/admin/security/secrets HTTP/1.1
Host: app.neostore.cloud
Authorization: Bearer YOUR_OAUTH2_TOKEN
Content-Type: application/json
Accept: */*
Content-Length: 35
{
"secret1": "text",
"secret2": "text"
}{
"type": null,
"title": null,
"status": null,
"detail": null,
"instance": null,
"ANY_ADDITIONAL_PROPERTY": "anything"
}Last updated

