Authentication

All CertifyOS API endpoints (except health checks) require a JWT bearer token issued by Auth0.

Sending the token

Include the token in the Authorization header of every request:

curl "https://api-service.staging.certifyos.com/practitioners" \
  -H "Authorization: Bearer <your-jwt>"

note

In the interactive API Explorer, paste only the raw token into the auth field — the Bearer prefix is added for you.

Obtaining a token

How you obtain a token depends on how your client is registered:

• Machine-to-machine integrations use the OAuth 2.0 client-credentials flow against your Auth0 tenant, with the API Layer as the audience.
• Interactive users receive tokens through the CertifyOS platform login flow.

Reach out to your CertifyOS administrator for client credentials scoped to the environment you need.

Permissions

Endpoints are protected by fine-grained RBAC permissions carried in the JWT. A 403 response means your token is valid but lacks the permission required by that endpoint — the required permission for each endpoint is enforced server-side.

Common errors

Status	Meaning	Fix
401 Unauthorized	Missing, expired, or malformed token	Obtain a fresh token; check the Authorization header format
403 Forbidden	Token lacks the required permission	Request the appropriate role/permission for your client