> ## Documentation Index
> Fetch the complete documentation index at: https://docs.timeback.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Request an access token

> Used to request a new token with the grant_type "client_credentials"



## OpenAPI

````yaml /openapi/learn-with-ai/platform-api.yaml post /auth/1.0/token
openapi: 3.1.1
info:
  title: TimeBack Platform API
  description: >-
    RESTful API for the TimeBack Platform. Covers authentication, rostering,
    curriculum, insights, assessments, content grading, and more.
  version: 2026.09.10.1
servers:
  - url: https://platform.dev.timeback.com
    description: integration
security: []
tags:
  - name: Auth
    description: Authentication and authorization endpoints
  - name: Organizations
    description: Organizations module contains all endpoints around organization management
  - name: Applications
    description: Applications module contains all endpoints for managing LTI applications
  - name: Users
    description: >-
      Users module contains all endpoints around user creation, update and
      consultation
  - name: Students
    description: Students module contains all endpoints around student management
  - name: Demographics
    description: >-
      Demographics module contains all endpoints around demographics
      consultation
  - name: Consent
    description: >-
      Initiate and query TimeBack parental consent for a student, backed by an
      immutable audit trail.
  - name: Classes
    description: Classes module contains all endpoints around class management
  - name: Courses
    description: Courses module contains all endpoints around course management
  - name: Enrollments
    description: Enrollments module contains all endpoints around enrollment consultation
  - name: CASE
    description: Competency and Academic Standards Exchange (CASE) 1.1 API
  - name: Curriculum
    description: Curriculum module contains endpoints for managing curriculum data
  - name: Competency Track
    description: Competency track endpoints
  - name: Content Grading
    description: >-
      Registration and management of graders for free-response content items —
      bring-your-own external graders (Tier 2) and, once shipped,
      platform-managed grading prompts (Tier 1).
  - name: Caliper
    description: The Caliper module contains all endpoints around Caliper Analytics
  - name: Insights
    description: Coaching insights and session analytics endpoints
paths:
  /auth/1.0/token:
    post:
      tags:
        - Auth
      summary: Request an access token
      description: Used to request a new token with the grant_type "client_credentials"
      operationId: getToken
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              $ref: '#/components/schemas/TokenRequest'
      responses:
        '200':
          description: Token response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/TokenResponse'
        '401':
          $ref: '#/components/responses/Unauthorized'
      security:
        - BasicAuth: []
components:
  schemas:
    TokenRequest:
      type: object
      required:
        - grant_type
      properties:
        grant_type:
          type: string
          enum:
            - client_credentials
        scope:
          type: string
          description: Space-separated list of scopes
        authorization_details:
          type: string
          description: >-
            RFC 9396 Rich Authorization Requests (subset). URL-encoded JSON
            array of typed objects. The value must be URL-encoded in the form
            body.


            **Supported types:**


            - `org_scope` — Narrow the token's org scope. Include `"locations"`
            with org UUIDs. The token's `custom:orgRoles` claim will contain
            only the requested orgs (must be a subset of the client's allowed
            orgs). Example: `[{"type":"org_scope","locations":["org-uuid-1"]}]`


            - `user_delegation` — Issue a user-scoped token. Provide at least
            one of:
              - `"subject"` — the target user's `sourcedId` (UUID).
              - `"subject_email"` — the target user's email (platform resolves to UUID internally).
            If both are provided, `subject` takes priority. The issued token
            carries a `custom:delegateUserId` claim set to the resolved user ID,
            enabling requester-scoped reads without the `requesterId` query
            param. The client must control the user's primary organization.
            Examples:
              `[{"type":"user_delegation","subject":"user-uuid"}]`
              `[{"type":"user_delegation","subject_email":"alice@school.org"}]`


            Both types can be combined in a single request.
    TokenResponse:
      type: object
      required:
        - access_token
        - token_type
        - expires_in
      properties:
        access_token:
          type: string
        token_type:
          type: string
          enum:
            - bearer
        expires_in:
          type: integer
          description: Token expiration time in seconds
        scope:
          type: string
          description: Space-separated list of granted scopes
  responses:
    Unauthorized:
      description: Unauthorized
  securitySchemes:
    BasicAuth:
      type: http
      scheme: basic
      description: >-
        Basic authentication using client_id as username and client_secret as
        password

````