Total Access Docs
Openapi

OAuth2 authorization endpoint

Validates an OAuth2 authorization request and redirects to the consent screen. Supports the Authorization Code flow with PKCE. Required query parameters: - `response_type` — must be `code` - `client_id` — OAuth2 app client ID - `redirect_uri` — must match a registered redirect URI - `scope` — space-separated list of requested scopes - `code_challenge` — PKCE code challenge - `code_challenge_method` — `S256` - `state` — opaque state string echoed back on redirect

GET
/api/v1/oauth/authorize

Validates an OAuth2 authorization request and redirects to the consent screen. Supports the Authorization Code flow with PKCE.

Required query parameters:

  • response_type — must be code
  • client_id — OAuth2 app client ID
  • redirect_uri — must match a registered redirect URI
  • scope — space-separated list of requested scopes
  • code_challenge — PKCE code challenge
  • code_challenge_method — S256
  • state — opaque state string echoed back on redirect

Query Parameters

response_type*"code"

Value in

  • "code"
client_id*string
redirect_uri*string
Formaturi
scope*string
code_challenge*string
code_challenge_method*"S256"

Value in

  • "S256"
state?string

Response Body

application/json

application/json

curl -X GET "https://example.com/api/v1/oauth/authorize?response_type=code&client_id=string&redirect_uri=http%3A%2F%2Fexample.com&scope=string&code_challenge=string&code_challenge_method=S256"
Empty
{  "success": false,  "error": {    "code": "BAD_REQUEST",    "message": "Request body is empty. Expected JSON with action field.",    "request_id": "req_abc123",    "documentation_url": "https://dev-developer.totalaccess.co.za/docs/api-reference/errors#bad_request"  }}
{  "success": false,  "error": {    "code": "UNAUTHORIZED",    "message": "API key required",    "request_id": "req_abc123",    "documentation_url": "https://dev-developer.totalaccess.co.za/docs/api-reference/errors#unauthorized"  }}

List webhook deliveries GET

Returns webhook delivery records with filtering and stats.

OAuth2 token endpoint POST

Exchanges an authorization code for access and refresh tokens, or refreshes an expired access token. Supports `authorization_code` and `refresh_token` grant types, as well as `client_credentials` for server-to-server. Accepts both `application/json` and `application/x-www-form-urlencoded` bodies.