Developers – API reference

Revoke OAuth token

POST/api/v1/oauth/revoke

Revocation as per RFC 7009. Body application/x-www-form-urlencoded with token (access or refresh token) and optionally token_type_hint. Client authentication as for the token endpoint. Revoking a refresh token also revokes all tokens derived from it. The response is always 200, even for unknown tokens.

No authentication required.

Response 200

Empty object

Possible errors: 400, 401, 429, 500

Response 200

{}

Issue or refresh OAuth token

POST/api/v1/oauth/token

Token endpoint as per RFC 6749. Body application/x-www-form-urlencoded.

Redeem authorisation code: grant_type=authorization_code, code, redirect_uri (if passed during authorisation), code_verifier (PKCE, mandatory for all apps).

Refresh: grant_type=refresh_token, refresh_token, optionally scope (subset).

Client authentication: HTTP Basic (client_id:client_secret) or client_id/client_secret in the body; public apps only client_id. Errors in OAuth format { "error": "invalid_grant", "error_description": "…" }. Every refresh returns a new refresh token; the old one becomes invalid. Parallel refreshes with the same refresh token within 30 s receive the same token pair as long as the new refresh token is unused; later reuse revokes the entire token chain.

No authentication required.

Response 200 · OAuthTokenResponse

access_tokenstringrequired
dfo_… (valid for 1 hour)
token_type"Bearer"required
expires_inintegerrequired
-9007199254740991–9007199254740991
refresh_tokenstringrequired
dfr_… (rotated on every use)
scopestringrequired
Granted scopes, space-separated

Possible errors: 400, 401, 429, 500

Response 200

{
  "access_token": "string",
  "token_type": "Bearer",
  "expires_in": 0,
  "refresh_token": "string",
  "scope": "string"
}

Retrieve OpenAPI description (3.1)

GET/api/v1/openapi.json

No authentication required.

Response 200

Empty object.

Possible errors: 400, 429, 500

curl 'https://www.debt-flow.io/api/v1/openapi.json'

Response 200

"string"