Access the APIs securely
Learn how to authenticate to airwiseOS and obtain the necessary tokens for API access. The platform supports multiple authentication flows to suit different integration needs, including server-to-server and user-based interactions.
Authentication
Supported Options
The airwiseOS API supports three authentication schemes. The required scheme is shown per endpoint on the API page.
- API Key — tenant-scoped header token for server-to-server integrations.
- Username / password via
API-airwise— short-lived bearer token for user or M2M sessions. - Client credentials via
UTM-airwise— scoped machine-to-machine bearer token for UTM / DSS integrations.
API Key
API keys are the default scheme for tenant-scoped integrations. Pass your key in the x-api-key request header.
curl \ --request GET \ --url "https://api.airwisesolutions.app/flights/v2/collections" \ --header "x-api-key: <your-api-key>" \ --header "Accept: application/json"
Username / password via API-airwise
Use the OAuth 2.0 password grant to exchange an airwiseOS email and password for a short-lived access token. Suitable for both interactive and server-side M2M use.
Step 1 — Obtain a token:
curl \ --request POST \ --url "https://sso.airwisesolutions.app/oauth2/token" \ --header "Content-Type: application/x-www-form-urlencoded" \ --data "grant_type=password" \ --data "client_id=<api-airwise-client-id>" \ --data "username=<email>" \ --data "password=<password>"
The response contains an access_token. It expires after one hour.
Step 2 — Call the API:
curl \ --request GET \ --url "https://api.airwisesolutions.app/flights/v2/collections" \ --header "Authorization: Bearer <access-token>" \ --header "Accept: application/json"
Client credentials via UTM-airwise
Use the OAuth 2.0 client_credentials grant for machine-to-machine UTM and DSS integrations. Your UTM-airwise client ID and secret are issued during onboarding.
Step 1 — Obtain a token:
curl \ --request POST \ --url "https://sso.airwisesolutions.app/oauth2/token" \ --header "Content-Type: application/x-www-form-urlencoded" \ --header "Authorization: Basic <base64(client_id:client_secret)>" \ --data "grant_type=client_credentials" \ --data "scope=<space-separated-scopes>"
Available scopes are listed on individual DSS endpoint documentation. The response contains an access_token valid for one hour.
Step 2 — Call the API:
curl \ --request POST \ --url "https://api.airwisesolutions.app/dss/v1/operational_intent_references/query" \ --header "Authorization: Bearer <access-token>" \ --header "Accept: application/json"