Access the APIs securely
Learn how to authenticate to airwiseOS and obtain the necessary tokens for API access. The platform supports multiple authentication flows to suit different integration needs, including server-to-server and user-based interactions.
Authentication
Supported Options
The airwiseOS API supports two authentication schemes. The required scheme is shown per endpoint on the API page.
- API Key — tenant-scoped header token for server-to-server integrations.
- OAuth 2.0 bearer token via the unified token endpoint — issued for
password,refresh_token, andclient_credentialsgrants, all from the same URL.
API Key
API keys are the default scheme for tenant-scoped integrations. Pass your key in the x-api-key request header.
curl \ --request GET \ --url "https://api.airwisesolutions.app/flights/v2/collections" \ --header "x-api-key: <your-api-key>" \ --header "Accept: application/json"
Token endpoint
All bearer-token grants are issued from a single endpoint:
https://api.airwisesolutions.app/token
Every response contains an access_token, valid for one hour, to send as Authorization: Bearer <access-token> on subsequent requests.
Username / password (grant_type=password)
Exchange an airwiseOS email and password for a token. Suitable for both interactive and server-side M2M use.
Step 1 — Obtain a token:
curl \ --request POST \ --url "https://api.airwisesolutions.app/token" \ --header "Content-Type: application/x-www-form-urlencoded" \ --data "grant_type=password" \ --data "client_id=aqfdlql0c0e5gn5i8l1cp39b1" \ --data "username=<email>" \ --data "password=<password>"
Step 2 — Call the API:
curl \ --request GET \ --url "https://api.airwisesolutions.app/flights/v2/collections" \ --header "Authorization: Bearer <access-token>" \ --header "Accept: application/json"
Refresh token (grant_type=refresh_token)
Exchange a refresh token (returned alongside the access token from a password grant) for a new access token without re-sending credentials.
curl \ --request POST \ --url "https://api.airwisesolutions.app/token" \ --header "Content-Type: application/x-www-form-urlencoded" \ --data "grant_type=refresh_token" \ --data "client_id=aqfdlql0c0e5gn5i8l1cp39b1" \ --data "refresh_token=<refresh-token>"
Client credentials (grant_type=client_credentials)
Use the OAuth 2.0 client_credentials grant for machine-to-machine UTM and DSS integrations. Your client ID and secret are issued during onboarding.
Step 1 — Obtain a token:
This grant supports two equivalent request styles — a POST body, or a GET request with the same fields as query-string parameters (matching the uss_qualifier mock DSS's contract, for integrators testing against both):
curl \ --request POST \ --url "https://api.airwisesolutions.app/token" \ --header "Content-Type: application/x-www-form-urlencoded" \ --header "Authorization: Basic <base64(client_id:client_secret)>" \ --data "grant_type=client_credentials" \ --data "scope=utm.strategic_coordination"
curl \ --request GET \ --url "https://api.airwisesolutions.app/token?grant_type=client_credentials&scope=utm.strategic_coordination" \ --header "Authorization: Basic <base64(client_id:client_secret)>"
scope is a space-separated list of unprefixed scope names (e.g. utm.strategic_coordination), not Cognito's internal resource-server-prefixed form (utm/utm.strategic_coordination) — the prefix is stripped/added automatically by the token endpoint. Available scopes are listed on individual DSS endpoint documentation.
Step 2 — Call the API:
curl \ --request POST \ --url "https://api.airwisesolutions.app/dss/v1/operational_intent_references/query" \ --header "Authorization: Bearer <access-token>" \ --header "Accept: application/json"