Current behavior for a Request Token, by default, the response is a "Full Access" token and doesn't require a scope to be specified:
curl --location --request POST 'https://5gedge.verizon.com/api/ts/v1/oauth2/token' \
--header 'Content-Type: application/x-www-form-urlencoded' \
--header 'Authorization: Basic {token}' \
--data-urlencode 'grant_type=client_credentials'
if no scopes are specified, TSCore will respond with the "Full Access" scope:
{"access_token":"{token}","scope":" ts.application.ro ts.mec.fullaccess","token_type":"Bearer","expires_in":3600}
What is changing
There will now be a "Full Access" and "Limited Access" scopes for the OAuth request token.
Full Access
Implicit Request:
First options with the current process will respond with a Full Access scope (By Default) just like the current request process:
curl --location --request POST 'https://5gedge.verizon.com/api/ts/v1/oauth2/token' \
--header 'Content-Type: application/x-www-form-urlencoded' \
--header 'Authorization: Basic {token}' \
--data-urlencode 'grant_type=client_credentials'
Response:
If the token is already migrated, or if the Access Token was generated using a new client/secret using the new services, the response will include the "Full Access" scope ( ts.mec.fullaccess ):
{"access_token":"{token}","scope":" ts.application.ro ts.mec.fullaccess","token_type":"Bearer","expires_in":1628}
Explicit Request:
The new explicit request requires two scopes to be specified (ts.application.ro and ts.mec.fullaccess):
curl --location --request POST 'https://5gedge.verizon.com/api/ts/v1/oauth2/token' \
--header 'Content-Type: application/x-www-form-urlencoded' \
--header 'Authorization: Basic {token}' \
--data-urlencode 'scope=ts.application.ro ts.mec.fullaccess' \
--data-urlencode 'grant_type=client_credentials'
Response:
Generating the access token using a client/secret, and the new services, the response will include the new scope ( ts.mec.fullaccess ):
{"access_token":"{token}","scope":"ts.application.ro ts.mec.fullaccess","token_type":"Bearer","expires_in":3600}
Limited Access
The new explicit request requires two scopes to be specified (ts.application.ro and ts.mec.limitaccess):
curl --location --request POST 'https://5gedge.verizon.com/api/ts/v1/oauth2/token' \
--header 'Content-Type: application/x-www-form-urlencoded' \
--header 'Authorization: Basic {token}' \
--data-urlencode 'scope=ts.application.ro ts.mec.limitaccess' \
--data-urlencode 'grant_type=client_credentials'
Response:
The response will include one new scope ( ts.mec.limitaccess ):
{"access_token":"{token}","scope":"ts.application.ro ts.mec.limitaccess","token_type":"Bearer","expires_in":3600}
New error responses
Token request with the wrong scope
Only the "Full Access" or "Limited Access" scopes can be used with the MEC API Endpoints. If an invalid token scope is requested the expected behavior is a 401 error. For example:
curl --location --request POST 'https://5gedge.verizon.com/api/ts/v1/oauth2/token' \
--header 'Content-Type: application/x-www-form-urlencoded' \
--header 'Authorization: Basic {token}' \
--data-urlencode 'scope=ts.application.ro ts.mec.invalidaccess' \
--data-urlencode 'grant_type=client_credentials'
will result in the folowing response:
{"status": "401","message": "Invalid Token or Scopes" }
Please note: a "Full Access" token is required for any of the /serviceprofiles or /serviceendpoints API endpoints. A "Limited Access" token only has access to the Discovery API endpoints. Please see the table below.
