Authentication

Machine-to-machine only, using OAuth 2.0 client_credentials against the customer system's IdentityServer. There is no interactive login path — this is a credential for your ETL job, not for a person.

Requesting a token

Token request

POST https://<identity-host>/connect/token
Content-Type: application/x-www-form-urlencoded

grant_type=client_credentials
&client_id=<Customer>-<ENV>-ticketinghub-client
&client_secret=<your secret>
&scope=ticketinghub-api

The token endpoint is IdentityServer's own host, not the API base URL — the data feed is proxied, the token flow is not.

Your client id follows the pattern <Customer>-<ENV>-ticketinghub-client. The secret is provisioned to you — access is gated by that secret, not by the client merely existing.

Token response

Send it on every request as Authorization: Bearer <access_token>. The gateway forwards it unchanged; the API behind it does the validating.

Three requirements, and the one that catches people

• The scope must be ticketinghub-api. A token issued for another ADITUS API will not open this one.
• The token must have no subject. ← This is the one. A user token is rejected with 403 even when it carries the correct scope. This surface answers to services, not to people acting through them. Using the client_credentials grant gives you a subject-less token by definition, so following the flow above is enough.
• The lifetime is 3600 seconds. Cache the token and reuse it across your whole extract; do not request one per page.

Both reference tokens and self-contained at+jwt tokens are accepted.

What is not supported

• No interactive login, no authorization-code flow, no refresh tokens. When the token expires, request a new one the same way.
• No CORS. This API cannot be called from browser-side code, deliberately — your secret has no business being in a browser.

Important: Your feed is scoped server-side to your own mandator. The constraint is applied before any query reaches the database, so you always see your own data and only your own data. There is no parameter that can widen it.

When it fails

See Errors for the full picture.