Authentication - Sanicus Connect Developer Hub

Overview

All Sanicus Connect APIs are secured with short-lived JWT Bearer tokens. Tokens are issued by the auth-server using customer-specific client credentials. Every API client is provisioned with a clientId and clientSecret that are bound to a specific user account — no username is passed in the request.

Obtaining a token

Call the auth-server token endpoint with your client credentials. Replace {server} with your environment hostname (e.g. services, service-test, or a regional server name). Endpoint

POST https://{server}.sanicus-connect.com/api/auth/token

Request body

{
  "clientId": "your-client-id",
  "clientSecret": "your-client-secret"
}

cURL example

curl -X POST "https://{server}.sanicus-connect.com/api/auth/token" \
  -H "Content-Type: application/json" \
  -d '{
    "clientId": "your-client-id",
    "clientSecret": "your-client-secret"
  }'

Successful response — HTTP 200

{
  "accessToken": "eyJhbGciOiJSUzI1NiJ9...",
  "tokenType": "Bearer",
  "expiresIn": 3600
}

Field	Description
`accessToken`	RS256-signed JWT. Use this in every subsequent API call.
`tokenType`	Always `"Bearer"`.
`expiresIn`	Validity in seconds. Tokens expire after 1 hour.

Error response — HTTP 401 Returned when the clientId or clientSecret is incorrect, or when the client has no associated user account.

Client credentials are provisioned by the Sanicus Connect platform team. Contact support@sanicus-connect.com to request API credentials for your tenant.

Using the token

Include the token in the Authorization header of every API request.

curl -X GET "https://{server}.sanicus-connect.com/acct-manager/tenant/list" \
  -H "Authorization: Bearer eyJhbGciOiJSUzI1NiJ9..." \
  -H "Content-Type: application/json"

JWT claims

The issued token carries the following claims, which downstream services use for authorisation.

Claim	Description
`user_id`	UUID of the authenticated user
`org_id`	UUID of the user’s organisation
`tenant`	UUID of the tenant
`username`	Username string
`role`	Primary platform role (e.g. `ORG_ADMIN`, `TENANT_ADMIN`)
`roles`	Full list of granted roles
`is_cleaner`	`true` if the user is a cleaner/staff account

Token expiry and renewal

Tokens are valid for 3600 seconds (1 hour). There is no refresh token — call POST /api/auth/token again with your client credentials to obtain a new token before the current one expires.

Service base URLs

Each service runs on its own context path. In production, all services are accessible through the API gateway.

Service	Context Path
Account Manager	`/acct-manager`
Asset Manager	`/asset-manager`
Staff Manager	`/staff`

Standard error codes

Code	Meaning
`200`	Success
`201`	Created
`400`	Bad request — check your request body or query parameters
`401`	Unauthorised — token is missing, invalid, or expired
`403`	Forbidden — token lacks permission for this resource
`404`	Not found
`409`	Conflict — resource already exists
`500`	Internal server error

Postman collections

Download a ready-to-use Postman collection for each service. Each collection includes:

All customer-facing endpoints organised by tag
Bearer token auth pre-configured as {{token}}
{{baseUrl}} collection variable set to the production URL

Set your token variable in Postman after importing, then start making calls.

Account Manager

Download collection

Asset Manager

Download collection

Staff Manager

Download collection

​Overview

​Obtaining a token

​Using the token

​JWT claims

​Token expiry and renewal

​Service base URLs

​Standard error codes

​Postman collections

Account Manager

Asset Manager

Staff Manager

Overview

Obtaining a token

Using the token

JWT claims

Token expiry and renewal

Service base URLs

Standard error codes

Postman collections