Authorization
Method
Description
Method
Description
POST
Obtain OAuth2 Client Credentials Token
https://api.honeywell.com/oauth2/accesstoken
The Authorization HTTP header for this request is a Base64 encoded value of apikey and apiSecret concatenated with a colon. For example if your API Key was 123abc and your Secret was 456def your HTTP header would look like this:
Authorization: Basic MTIzYWJjOjQ1NmRlZg==
curl -X POST -H "Authorization: Basic MTIzYWJjOjQ1NmRlZg==" -H "Content-Type: application/x-www-form-urlencoded" -d 'grant_type=client_credentials'
The result!
As long as everything else went OK you will receive a response that looks like this:
{
"refresh_token_expires_in": "0",
"api_product_list": "[Basic Plan]",
"organization_name": "connectedhome",
"developer.email": "developerinfo@resideo.com",
"token_type": "BearerToken",
"issued_at": "1487281223451",
"client_id": "123abc",
"access_token": "456def",
"application_name": "b1bd4907-924a-4470-a641-0effeb279834",
"scope": "user",
"expires_in": "3599",
"refresh_count": "0",
"status": "approved"
}
GET
Get an Authorization Code
https://api.honeywell.com/oauth2/authorize
This call is meant to be done in a browser, this will redirect a user to a login page. Once the user logs-in and consents to the access rights for your application, a redirect will occur to the Redirect URI defined in the query parameter along with an Authorization Code included in the query string as "code=". The Redirect URI must match was is defined in your Application config.
POST
Refresh a Token
https://api.honeywell.com/oauth2/token
Refreshing a token is similar to the last step in the authorization code flow.
One thing in particular to pay attention to is the Authorization header. It's a Basic Auth challenge using your API Key and API Secret (sometimes called clientID and clientSecret). The two values are concatenated with a colon and the entire string is base64 encoded.
Example:
ClientID == 123 & Client Secret == abc
base64Encode(123:abc) == "MTIzOmFiYw=="
So the HTTP Header would be:
Authorization: Basic MTIzOmFiYw==
POST
Create a Token from an Authorization Code
https://api.honeywell.com/oauth2/token
This is used after obtaining an authorization code from the /authorize resource.
Pay attention to the Authorization HTTP Header: Base 64 encoded concatenation of client_id and client_secret with a colon.
Example:
client_id = 9UY8NrmDtIh8GVTkNdX0Y7I6k37254a9
client_secret = Z1947381rwgf0WkPPGPHnGik6h3LdhZ9
Concatenated value: 9UY8NrmDtIh8GVTkNdX0Y7I6k37254a9:Z1947381rwgf0WkPPGPHnGik6h3LdhZ9
Base64 Encoded Value: OVVZOE5ybUR0SWg4R1ZUa05kWDBZN0k2azM3MjU0YTk6WjE5NDczODFyd2dmMFdrUFBHUEhuR2lrNmgzTGRoWjk=
Header:
Authorization: Basic OVVZOE5ybUR0SWg4R1ZUa05kWDBZN0k2azM3MjU0YTk6WjE5NDczODFyd2dmMFdrUFBHUEhuR2lrNmgzTGRoWjk=