Skip to content

Add OAuth curl examples and improve authentication documentation #178

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Eric Zwaal (ezw2000) merged 9 commits into from
Aug 26, 2026
+248 −32
Merged

Add OAuth curl examples and improve authentication documentation #178

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
5aff9d6
Add OAuth curl examples with response samples
ezw2000 Aug 26, 2026
53347da
Restore parameter descriptions in Authorization Code flow
ezw2000 Aug 26, 2026
07bb9e3
Add OAuth curl examples with response samples (English)
ezw2000 Aug 26, 2026
705dba7
Update curl examples with realistic API endpoints and response formats
ezw2000 Aug 26, 2026
9e076e9
PROJECT#RSY00007 Verbetering OAuth documentatie
ezw2000 Aug 26, 2026
02e498e
Fix typo in Accept endpoint description (Dutch)
ezw2000 Aug 26, 2026
490581a
Update frontmatter date to 2026-08-26
ezw2000 Aug 26, 2026
e302c21
Potential fix for pull request finding
ezw2000 Aug 26, 2026
b3556fb
Potential fix for pull request finding
ezw2000 Aug 26, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
140 changes: 124 additions & 16 deletions markdownpages/profit/en/authentication.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
---
author: CLN
date: 2026-07-31
date: 2026-08-26
tags: GetConnector, AppConnector, Integration, Configuration, Authentication, Authorization
title: Authentication
---
Expand Down Expand Up @@ -82,8 +82,8 @@ To access the API, follow these steps:
1. Obtain an access token
1. Call the [token endpoint](#token-endpoint) (POST) with the following information in the body:
1. grant_type: client_credentials
2. client_id: `<fill in client id>`
3. client_secret: `<fill in client secret>`
2. client_id: `<CLIENT_ID>`
3. client_secret: `<CLIENT_SECRET>`
2. In the response of this call you will find the following fields:
1. access_token: the access token you must add to the Authorization header.
2. refresh_token: for the client credentials flow this is always "null".
Expand All @@ -92,6 +92,53 @@ To access the API, follow these steps:
3. Use the access token
1. Copy the access token, prefix it with 'Bearer', and add it to your Authorization header.

#### cURL examples

**Retrieve token:**
```bash
curl -X POST https://<environmentnumber>.rest.afas.online/ProfitRestServices/oauth/token \
-H "Content-Type: application/x-www-form-urlencoded" \
-d "grant_type=client_credentials" \
-d "client_id=<CLIENT_ID>" \
-d "client_secret=<CLIENT_SECRET>"
```

**Response example:**
```json
{
"access_token": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...",
"token_type": "Bearer",
"expires_in": 3600,
"refresh_token": null
}
```

**API call with token:**
```bash
curl -X GET "https://<environmentnumber>.rest.afas.online/ProfitRestServices/connectors/Profit_Address?skip=0&take=100" \
-H "Accept: application/json" \
-H "Authorization: Bearer <ACCESS_TOKEN>"
```

**Response example:**
```json
{
"skip": 0,
"take": 100,
"rows": [
{
"AddressId": 1,
"AddressLine": "Stadsring 69, 3811 HN AMERSFOORT",
"PoBox": false,
"Address": "Stadsring",
"Number": 69,
"ZipCode": "3811 HN",
"Recidence": "Amersfoort",
"Country": "NL"
}
]
}
```

### Authorization code flow with PKCE

Expand All @@ -104,20 +151,20 @@ To access the API via the Authorization Code Flow, follow these steps:
1. Obtain an authorization code
1. Redirect the user to the [authorization endpoint](#authorization-endpoint) (GET) with the following parameters:
1. response_type: code
2. client_id: `<fill in client id>`
3. redirect_uri: `<fill in redirect URI>`
4. scope: `<fill in desired scopes>`
2. client_id: `<CLIENT_ID>`
3. redirect_uri: `<REDIRECT_URI>`
4. scope: `<SCOPE>`
5. state: `<optional unique value to protect against CSRF>`
6. code_challenge: `<fill in codeChallenge>`
7. code_challenge_method: `<fill in codeChallenge method>`
2. The user logs in and grants permission. After granting permission the user is redirected back to the provided redirect_uri with an authorization code.
2. Exchange the authorization code for an access token
1. Call the [token endpoint](#token-endpoint) (POST) with the following information in the body:
1. grant_type: authorization_code
2. code: `<replace with obtained authorization code>`
3. redirect_uri: `<fill in redirect URI>`
4. client_id: `<fill in client id>`
5. client_secret: `<fill in client secret>`
2. code: `<AUTHORIZATION_CODE>`
3. redirect_uri: `<REDIRECT_URI>`
4. client_id: `<CLIENT_ID>`
5. client_secret: `<CLIENT_SECRET>`
6. code_verifier: `<fill in code verifier>`
3. In the response of this call you will find the following fields:
1. access_token: the access token you must add to the Authorization header.
Expand All @@ -127,22 +174,83 @@ To access the API via the Authorization Code Flow, follow these steps:
3. Use the access token
1. Copy the access token, prefix it with 'Bearer', and add it to your Authorization header.

#### cURL examples

**Step 1: Redirect user to authorization endpoint:**
```bash
# Open this URL in a browser:
https://<environmentnumber>.rest.afas.online/ProfitRestServices/oauth/authorize?response_type=code&client_id=<CLIENT_ID>&redirect_uri=<REDIRECT_URI>&scope=<SCOPE>&state=<STATE>&code_challenge=<CODE_CHALLENGE>&code_challenge_method=S256
```

**Step 2: Retrieve token with authorization code:**
```bash
curl -X POST https://<environmentnumber>.rest.afas.online/ProfitRestServices/oauth/token \
-H "Content-Type: application/x-www-form-urlencoded" \
-d "grant_type=authorization_code" \
-d "code=<AUTHORIZATION_CODE>" \
-d "redirect_uri=<REDIRECT_URI>" \
-d "client_id=<CLIENT_ID>" \
-d "client_secret=<CLIENT_SECRET>" \
-d "code_verifier=<CODE_VERIFIER>"
```

**Response example:**
```json
{
"access_token": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...",
"token_type": "Bearer",
"expires_in": 3600,
"refresh_token": "50c90d85-a7aa-4e8a-a9b8-..."
}
```

**Step 3: API call with token:**
```bash
curl -X GET "https://<environmentnumber>.rest.afas.online/ProfitRestServices/connectors/Profit_Address?skip=0&take=100" \
-H "Accept: application/json" \
-H "Authorization: Bearer <ACCESS_TOKEN>"
```

**Response example:**
```json
{
"skip": 0,
"take": 100,
"rows": [
{
"AddressId": 1,
"AddressLine": "Stadsring 69, 3811 HN AMERSFOORT",
"PoBox": false,
"Address": "Stadsring",
"Number": 69,
"ZipCode": "3811 HN",
"Recidence": "Amersfoort",
"Country": "NL"
}
]
}
```

### OAuth & SOAP API
The description above for both flows also applies when using the SOAP API. It is important to include the Bearer token in the header and not in the body.

### Token endpoint
Production: https://`<omgevingsnummer>`.rest.afas.online/ProfitRestServices/oauth/token
These endpoints apply to both REST and SOAP.

Accept: : https://`<omgevingsnummer>`.restaccept.afas.online/ProfitRestServices/oauth/token
**Production**: https://`<environmentnumber>`.rest.afas.online/ProfitRestServices/oauth/token

Test: https://`<omgevingsnummer>`.resttest.afas.online/ProfitRestServices/oauth/token
**Accept**: https://`<environmentnumber>`.restaccept.afas.online/ProfitRestServices/oauth/token

**Test**: https://`<environmentnumber>`.resttest.afas.online/ProfitRestServices/oauth/token

### Authorization endpoint
Production: https://`<omgevingsnummer>`.rest.afas.online/ProfitRestServices/oauth/authorize
These endpoints apply to both REST and SOAP.

**Production**: https://`<environmentnumber>`.rest.afas.online/ProfitRestServices/oauth/authorize

Accept: https://`<omgevingsnummer>`.restaccept.afas.online/ProfitRestServices/oauth/authorize
**Accept**: https://`<environmentnumber>`.restaccept.afas.online/ProfitRestServices/oauth/authorize

Test: https://`<omgevingsnummer>`.resttest.afas.online/ProfitRestServices/oauth/authorize
**Test**: https://`<environmentnumber>`.resttest.afas.online/ProfitRestServices/oauth/authorize

### Read more

Expand Down
140 changes: 124 additions & 16 deletions markdownpages/profit/nl/authentication.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
---
author: CLN
date: 2026-07-31
date: 2026-08-26
tags: GetConnector, AppConnector, Integration, Configuration, Authentication, Authorization
title: Authenticatie
---
Expand Down Expand Up @@ -81,8 +81,8 @@ Om toegang te krijgen tot de API, volg je de volgende stappen:
1. Access token ophalen
1. Roep het [token endpoint](#token-endpoint) (POST) aan met de volgende informatie in de body:
1. grant_type: client_credentials
2. client_id: `<vul client id in>`
3. client_secret: `<vul client secret in>`
2. client_id: `<CLIENT_ID>`
3. client_secret: `<CLIENT_SECRET>`
2. In de response van deze aanroep vind je de volgende velden:
1. access_token: de access token die je in de Authorization header moet toevoegen.
2. refresh_token: is bij de client credentials flow altijd "null".
Expand All @@ -91,6 +91,53 @@ Om toegang te krijgen tot de API, volg je de volgende stappen:
3. Access token gebruiken
1. Kopieer de access token, zet er 'Bearer' voor, en voeg hem toe in je Authorization header.

#### cURL voorbeelden

**Token ophalen:**
```bash
curl -X POST https://<omgevingsnummer>.rest.afas.online/ProfitRestServices/oauth/token \
-H "Content-Type: application/x-www-form-urlencoded" \
-d "grant_type=client_credentials" \
-d "client_id=<CLIENT_ID>" \
-d "client_secret=<CLIENT_SECRET>"
```

**Response voorbeeld:**
```json
{
"access_token": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...",
"token_type": "Bearer",
"expires_in": 3600,
"refresh_token": null
}
```

**API aanroep met token:**
```bash
curl -X GET "https://<omgevingsnummer>.rest.afas.online/ProfitRestServices/connectors/Profit_Address?skip=0&take=100" \
-H "Accept: application/json" \
-H "Authorization: Bearer <ACCESS_TOKEN>"
```

**Response voorbeeld:**
```json
{
"skip": 0,
"take": 100,
"rows": [
{
"AddressId": 1,
"AddressLine": "Stadsring 69, 3811 HN AMERSFOORT",
"PoBox": false,
"Address": "Stadsring",
"Number": 69,
"ZipCode": "3811 HN",
"Recidence": "Amersfoort",
"Country": "NL"
}
]
}
```

### Authorization code flow with PKCE

Expand All @@ -103,20 +150,20 @@ Om toegang te krijgen tot de API via de Authorization Code Flow, volg je de volg
1. Verkrijg een Autorisatiecode
1. Leid de gebruiker naar het [autorisatie endpoint](#authorization-endpoint) (GET) met de volgende parameters:
1. response_type: code
2. client_id: `<vul client id in>`
3. redirect_uri: `<vul redirect URI in>`
4. scope: `<vul gewenste scopes in>`
2. client_id: `<CLIENT_ID>`
3. redirect_uri: `<REDIRECT_URI>`
4. scope: `<SCOPE>`
5. state: `<optionele unieke waarde ter bescherming tegen CSRF>`
6. code_challenge: `<vul codeChallenge in>`
7. code_challenge_method: `<vul codeChallenge methode in>`
2. De gebruiker logt in en geeft toestemming. Na toestemming wordt de gebruiker teruggeleid naar de opgegeven redirect_uri met een autorisatiecode.
2. Wissel de Autorisatiecode in voor een Access Token
1. Roep het [token endpoint](#token-endpoint) (POST) aan met de volgende informatie in de body:
1. grant_type: authorization_code
2. code: `<vervang met verkregen autorisatiecode>`
3. redirect_uri: `<vul redirect URI in>`
4. client_id: `<vul client id in>`
5. client_secret: `<vul client secret in>`
2. code: `<AUTHORIZATION_CODE>`
3. redirect_uri: `<REDIRECT_URI>`
4. client_id: `<CLIENT_ID>`
5. client_secret: `<CLIENT_SECRET>`
6. code_verifier: `<vul code verifier in>`
3. In de response van deze aanroep vind je de volgende velden:
1. access_token: de access token die je in de Authorization header moet toevoegen.
Expand All @@ -126,23 +173,84 @@ Om toegang te krijgen tot de API via de Authorization Code Flow, volg je de volg
3. Access Token Gebruiken
1. Kopieer de access token, zet er 'Bearer' voor, en voeg hem toe in je Authorization header.

#### cURL voorbeelden

**Stap 1: Gebruiker redirecten naar autorisatie endpoint:**
```bash
# Open deze URL in een browser:
https://<omgevingsnummer>.rest.afas.online/ProfitRestServices/oauth/authorize?response_type=code&client_id=<CLIENT_ID>&redirect_uri=<REDIRECT_URI>&scope=<SCOPE>&state=<STATE>&code_challenge=<CODE_CHALLENGE>&code_challenge_method=S256
```

**Stap 2: Token ophalen met autorisatiecode:**
```bash
curl -X POST https://<omgevingsnummer>.rest.afas.online/ProfitRestServices/oauth/token \
-H "Content-Type: application/x-www-form-urlencoded" \
-d "grant_type=authorization_code" \
-d "code=<AUTHORIZATION_CODE>" \
-d "redirect_uri=<REDIRECT_URI>" \
-d "client_id=<CLIENT_ID>" \
-d "client_secret=<CLIENT_SECRET>" \
-d "code_verifier=<CODE_VERIFIER>"
```

**Response voorbeeld:**
```json
{
"access_token": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...",
"token_type": "Bearer",
"expires_in": 3600,
"refresh_token": "50c90d85-a7aa-4e8a-a9b8-..."
}
```

**Stap 3: API aanroep met token:**
```bash
curl -X GET "https://<omgevingsnummer>.rest.afas.online/ProfitRestServices/connectors/Profit_Address?skip=0&take=100" \
-H "Accept: application/json" \
-H "Authorization: Bearer <ACCESS_TOKEN>"
```

**Response voorbeeld:**
```json
{
"skip": 0,
"take": 100,
"rows": [
{
"AddressId": 1,
"AddressLine": "Stadsring 69, 3811 HN AMERSFOORT",
"PoBox": false,
"Address": "Stadsring",
"Number": 69,
"ZipCode": "3811 HN",
"Recidence": "Amersfoort",
"Country": "NL"
}
]
}
```

### OAuth & SOAP API
Bovenstaande beschrijving voor beide flows geldt ook wanneer je gebruikmaakt van de SOAP API. Het is belangrijk dat je het Bearer-token meegeeft in de header en niet in de body.


### Token endpoint
Productie: https://`<omgevingsnummer>`.rest.afas.online/ProfitRestServices/oauth/token
Deze endpoints gelden zowel voor REST als voor SOAP.

Accept: : https://`<omgevingsnummer>`.restaccept.afas.online/ProfitRestServices/oauth/token
**Productie**: https://`<omgevingsnummer>`.rest.afas.online/ProfitRestServices/oauth/token

Test: https://`<omgevingsnummer>`.resttest.afas.online/ProfitRestServices/oauth/token
**Accept**: https://`<omgevingsnummer>`.restaccept.afas.online/ProfitRestServices/oauth/token

**Test**: https://`<omgevingsnummer>`.resttest.afas.online/ProfitRestServices/oauth/token

### Authorization endpoint
Productie: https://`<omgevingsnummer>`.rest.afas.online/ProfitRestServices/oauth/authorize
Deze endpoints gelden zowel voor REST als voor SOAP.

**Productie**: https://`<omgevingsnummer>`.rest.afas.online/ProfitRestServices/oauth/authorize

Accept: https://`<omgevingsnummer>`.restaccept.afas.online/ProfitRestServices/oauth/authorize
**Accept**: https://`<omgevingsnummer>`.restaccept.afas.online/ProfitRestServices/oauth/authorize

Test: https://`<omgevingsnummer>`.resttest.afas.online/ProfitRestServices/oauth/authorize
**Test**: https://`<omgevingsnummer>`.resttest.afas.online/ProfitRestServices/oauth/authorize



Expand Down
Loading