> ## Documentation Index
> Fetch the complete documentation index at: https://developer.buildpass.global/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication token

> Generate an OAuth token to access the BuildPass API



## OpenAPI

````yaml POST /oauth/token
openapi: 3.0.0
info:
  title: BuildPass API
  description: >-
    Approved integrators can connect to the BuildPass API on behalf of builders
    to build connections between a wide range of construction platforms.
  version: 1.0.0
servers:
  - url: https://api.buildpass.global
    description: Production server
security:
  - OAuth2: []
paths:
  /oauth/token:
    post:
      description: Generate an OAuth token to access the BuildPass API
      operationId: getOAuthToken
      requestBody:
        description: Client credentials to obtain OAuth token
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/TokenRequest'
          application/x-www-form-urlencoded:
            schema:
              $ref: '#/components/schemas/TokenRequest'
      responses:
        '200':
          description: Token response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/TokenResponse'
        '400':
          description: Bad Request - Invalid request parameters or scope
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OAuthErrorResponse'
        '401':
          description: Unauthorized - Invalid client credentials
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OAuthErrorResponse'
        '500':
          description: Internal Server Error
      security: []
components:
  schemas:
    TokenRequest:
      type: object
      properties:
        client_id:
          type: string
          description: >-
            Your client ID. Can be provided in request body or via HTTP Basic
            Authentication.
          example: your_client_id
        client_secret:
          type: string
          description: >-
            Your client secret. Can be provided in request body or via HTTP
            Basic Authentication.
          example: your_client_secret
        scope:
          type: string
          description: >-
            The scopes you want to request access to. Available:
            `read:builders`, `read:subcontractors`, `read:prequalifications`,
            `read:insurances`, `read:swms`, `read:timesheets`, `read:contacts`,
            `read:inductions`, `read:meetings`, `write:meetings`.
          example: >-
            read:builders read:subcontractors read:prequalifications
            read:insurances
        audience:
          type: string
          description: The audience for the token (resource server identifier).
          enum:
            - https://api.buildpass.global
          example: https://api.buildpass.global
        grant_type:
          type: string
          description: >-
            The grant type you want to use. Currently only `client_credentials`
            is supported.
          enum:
            - client_credentials
          example: client_credentials
      required:
        - scope
        - audience
        - grant_type
    TokenResponse:
      type: object
      properties:
        access_token:
          type: string
          description: >-
            The access token that can be used in the Authorization header to
            access the API.
          example: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...
        token_type:
          type: string
          description: The type of token that was issued.
          example: Bearer
        expires_in:
          type: integer
          description: The number of seconds until the token expires.
          example: 3600
        expires:
          type: integer
          description: >-
            The number of seconds until the token expires. Deprecated, use
            expires_in instead.
          example: 3600
        scope:
          type: string
          description: The scopes that were granted for this token.
          example: read:builders read:subcontractors
      required:
        - access_token
        - token_type
        - expires_in
    OAuthErrorResponse:
      type: object
      properties:
        error:
          type: string
          enum:
            - invalid_request
            - invalid_client
            - invalid_grant
            - unauthorized_client
            - unsupported_grant_type
            - invalid_scope
          description: OAuth 2.0 error code as defined in RFC 6749
          example: invalid_client
        error_description:
          type: string
          description: Human-readable description of the error
          example: Invalid client credentials
        error_uri:
          type: string
          description: Optional URI for more information about the error
          example: https://tools.ietf.org/html/rfc6749#section-5.2
      required:
        - error
  securitySchemes:
    OAuth2:
      type: oauth2
      flows:
        clientCredentials:
          tokenUrl: https://api.buildpass.global/oauth/token
          scopes:
            read:subcontractors: Read subcontractors
            write:subcontractors: Write subcontractors
            read:prequalifications: Read prequalifications
            write:prequalifications: Write prequalifications
            read:insurances: Read insurances
            write:insurances: Write insurances
            read:contacts: Read contacts
            read:swms: Read SWMS
            read:timesheets: Read timesheets
            read:inductions: Read inductions
            read:meetings: Read meetings
            write:meetings: Write meetings
            read:photos: Read photos and photo folders
            write:photos: Create, update, delete, and sync photos and photo folders

````