# REST API Usage

**URL:** <https://community.gladysassistant.com/t/utilisation-api-rest/8372>\
**Category:** Configuration\
**Tags:** auth-apikey, api\
**Created:** [September 22, 2023, 4:20pm UTC](https://community.gladysassistant.com/t/utilisation-api-rest/8372 "2023-09-22T16:20:12Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Terdious](https://gladys-assistant-community.b-cdn.net/user_avatar/community.gladysassistant.com/terdious/32/6316_2.png) [@Terdious](https://community.gladysassistant.com/u/Terdious)\
**Post date:** [September 22, 2023, 4:20pm UTC](https://community.gladysassistant.com/t/utilisation-api-rest/8372/1 "2023-09-22T16:20:12Z")

</div>

Hello,

I would like to make requests properly on Node-RED. No problem with authentication and the access\_token. But in the docs it says you must use the refresh\_token (valid 30 days) to obtain a new access\_token (valid 24h) and that you should consult the API doc for more information:

 ![image](https://gladys-assistant-community.b-cdn.net/uploads/default/original/2X/a/ad2f6f67f607e899d3ec4855eba668e429389171.png)

However, the apiDoc is sorely lacking in information, I find:

 ![image](https://gladys-assistant-community.b-cdn.net/uploads/default/original/2X/f/fec674e599c1ed9c1725c2583e50c64698dcb058.png)  
How do you use the refresh\_token here?

Thanks in advance to anyone who can help me.

---

<div class="post-metadata">

**Author:** ![cicoub13](https://gladys-assistant-community.b-cdn.net/user_avatar/community.gladysassistant.com/cicoub13/32/4482_2.png) [@cicoub13](https://community.gladysassistant.com/u/cicoub13)\
**Post date:** [September 22, 2023, 7:07pm UTC](https://community.gladysassistant.com/t/utilisation-api-rest/8372/2 "2023-09-22T19:07:44Z")

</div>

When you call:

```auto
curl --location --request POST 'http://GLADYS_IP_ADDRESS/api/v1/login' \
--header 'Content-Type: application/json;charset=UTF-8' \
--data-raw '{"email":"\u003cemail\u003e","password":"\u003cpassword\u003e"}'

```

You get 2 tokens (in addition to the user info):

```auto
{
"id":"\u003cuuid\u003e",
"firstname":"Cyril",
"lastname":"Beslay",
"email":"\u003cemail\u003e",
"language":"fr",
"birthdate":"1989-04-13",
"role":"admin",
"created_at":"2021-11-21T19:01:37.013Z",
"updated_at":"2023-09-22T18:56:11.389Z",
"refresh_token":"\u003crefresh_token\u003e",
"access_token":"\u003caccess_token\u003e",
"session_id":"\u003cuuid\u003e"
}

```

You can use the `access_token` in API calls as indicated in the documentation.  
For example:

```auto
curl --location --request GET 'http://GLADYS_IP_ADDRESS/api/v1/me' \
--header 'Accept: application/json, text/plain, */*' \
--header 'authorization: Bearer \u003caccess_token\u003e'

```

When the `access_token` expires, you can use the `refresh_token` in this way to get a new one:

```auto
curl --location --request POST 'http://GLADYS_IP_ADDRESS/api/v1/access_token' \
--header 'Content-Type: application/json;charset=UTF-8' \
--data-raw '{"refresh_token":"\u003crefresh_token\u003e"}'

```

You get:

```auto
{
"access_token":"\u003cnew_access_token\u003e"
}

```

**Bonus 💡**  
You can use the site [https://jwt.io/](https://jwt.io/) to understand the content of a token (access or refresh)

---

<div class="post-metadata">

**Author:** ![Terdious](https://gladys-assistant-community.b-cdn.net/user_avatar/community.gladysassistant.com/terdious/32/6316_2.png) [@Terdious](https://community.gladysassistant.com/u/Terdious)\
**Post date:** [September 22, 2023, 7:38pm UTC](https://community.gladysassistant.com/t/utilisation-api-rest/8372/3 "2023-09-22T19:38:22Z")

</div>

> [@cicoub13](#):
>
> When the `access_token` expires, you can use the `refresh_token` like this to get a new one:
> 
> ```auto
> curl --location --request POST 'http://GLADYS_IP_ADDRESS/api/v1/access_token' \
> --header 'Content-Type: application/json;charset=UTF-8' \
> --data-raw '{"refresh_token":"\u003crefresh_token\u003e"}'
> 
> ```
> 
> You get:
> 
> ```auto
> {
> "access_token":"\u003cnew_access_token\u003e"
> }
> 
> ```
> 
> **Bonus 💡**  
> You can use the site [https://jwt.io/](https://jwt.io/) to understand the contents of a token (access or refresh)

Thank you very much @cicoub13 !! I thought I had done it correctly, but I had a 500 error… maybe it can only be done once the access\_token has expired… or maybe I did it wrong ^^

It would still be good to revisit the REST API documentation to add example data-raw and responses. They are for the most part nonexistent.