TokenTimer Core API Contract
TokenTimer Core API for authentication, workspaces, token lifecycle management, alerts, audit, and integration import/scan workflows. This contract is also used as a compatibility baseline across core, cloud, and enterprise variants.
Authentication
- API Key: cookieAuth
- HTTP: Bearer Auth
- HTTP: Bearer Auth
- HTTP: Bearer Auth
Session cookie authentication used by authenticated API routes.
Security Scheme Type: | apiKey |
|---|---|
Cookie parameter name: | sessionId |
Scoped CertOps API token (bearer) used by M2 machine routes. Allowed M2 scopes are certops:read, certops:events:write, certops:jobs:read, and certops:evidence:write. certops:read implies certops:jobs:read only, never a write scope. Bearer-only and non-cookie; CSRF-exempt only for the exact planned POST machine routes. Empty required-scope configuration is invalid.
Security Scheme Type: | http |
|---|---|
HTTP Authorization Scheme: | bearer |
Single-use, hashed, expiring bootstrap enrollment token used only by POST /api/v1/certops/agent/register. Exchanged for a per-agent credential at registration.
Security Scheme Type: | http |
|---|---|
HTTP Authorization Scheme: | bearer |
Per-agent credential (bearer) issued at registration, used for agent heartbeat, job claim, and result/evidence calls. CSRF-exempt. Not valid for registration.
Security Scheme Type: | http |
|---|---|
HTTP Authorization Scheme: | bearer |