Authentication

To access the Harri API, you need to authenticate by generating an OAuth2 token. This token will be used in the Authorization header for subsequent API requests. The steps below describe how to generate the token and use it.

Generating the Token

To obtain an authentication token, make a POST request to the /oauth2/token endpoint. You need to provide the client_id, client_secret, and grant_type as parameters in the request body.

Please do not generate a new token for every call. See the Token Expiration section below for when you should generate a new token.

Request Parameters

• client_id: The client ID issued to you by Harri.
• client_secret: The client secret issued to you by Harri.
• grant_type: The type of grant being used. For client credentials, use "client_credentials".

Request

Use the following curl command to generate the token, replacing <YOUR_CLIENT_ID> and <YOUR_CLIENT_SECRET> with your actual credentials:

curl -X POST https://oauth.harri.com/oauth2/token \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d '{
    "client_id": "<YOUR_CLIENT_ID>",
    "client_secret": "<YOUR_CLIENT_SECRET>",
    "grant_type": "client_credentials"
  }'

A successful response will return a JSON object containing the access token:

{
  "access_token": "eyJraWQiOiJMMVN3eHpYazZGbjdGUWpjam9a...Shw7_zasmFpPTMGqiK1kNLYFOyp_FEIfOzyQ",
  "expires_in": 1800,
  "token_type": "Bearer"
}

Use the access_token to authenticate subsequent requests.

Using the Token

After obtaining the token, include it in the Authorization header of your API requests. Here’s how to use the token in an API request:

curl -X GET https://gateway.harri.com/open-api-hub/api/v1/employees \
  -H "Authorization: Bearer <YOUR_ACCESS_TOKEN>"

Remember to replace <YOUR_ACCESS_TOKEN> with the actual token obtained in the previous step.

Token Expiration

The expires_in field in the response indicates the token's lifetime in seconds. After the token expires, you'll need to request a new one.

You should only generate one token per expiration period and use that token for all requests made within the expiration period. There is no need to generate a new token for each request and generating too many token requests per expiration period is discouraged.

Troubleshooting

If you encounter an Unauthorized error (HTTP status 401), ensure that:

• The client_id and client_secret are correct.
• The Authorization header is correctly formatted.
• The token has not expired.