Authentication

Exchange your API client's credentials for a 15-minute bearer token (OAuth 2.0 client credentials, RFC 6749 §4.4). Cache it and renew it shortly before it expires.

Base URL https://sandbox-api.wathiqaty.com/api/v1 (sandbox) · https://api.wathiqaty.com/api/v1 (production)

Get an access token

POST/auth/partner/token

Basic auth (client credentials)

Send the client id and secret with HTTP Basic auth. There is no refresh token: ask again with the same credentials. This route is limited to 10 calls a minute per client.

Body (form-encoded)

Name	Description
`grant_type` stringrequired	Always `client_credentials`. One of: `client_credentials`
`scope` string	Space-separated subset of the client's scopes. Omit it to get them all.

Errors

Status	Code	When
400	`invalid_scope`	A requested scope isn't granted to this client.
401	`invalid_client`	Unknown client, wrong secret, or the client is revoked.
403	`ip_not_allowed`	The client has an IP allow-list and this IP isn't on it.
403	`tenant_not_active`	Your company is suspended on Wathiqaty.
429	`rate_limited`	More than 10 token requests a minute. Cache tokens.

Plus the generic errors any route can return: Errors.

curl -X POST "https://sandbox-api.wathiqaty.com/api/v1/auth/partner/token" \
  -u "$CLIENT_ID:$CLIENT_SECRET" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "grant_type=client_credentials&scope=policies%3Aread+claims%3Aread+claims%3Awrite"

200 · A token.

{
  "status": "success",
  "data": {
    "accessToken": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9…",
    "tokenType": "Bearer",
    "expiresIn": 900,
    "scope": "policies:read claims:read claims:write"
  },
  "error": null,
  "metadata": {
    "timestamp": "2026-11-05T09:15:02.481Z",
    "path": "/api/v1/auth/partner/token",
    "method": "POST",
    "requestId": "8d7e2c1a-41f0-4a4e-9a55-6f0b3c2d1e77"
  }
}