Partner

Submit API token application

Create a partner api token for 1 or more organizations. A token created with an api token must expire (expiresAtMs) no later than that token and at most 365 days from now, and is deleted with it. Certificate tokens get a certificate valid for 365 days, or until the token expires if sooner.

POST/api/partner/submitApiTokenApplication

Authorizations

x-auth-apikeystringheaderrequired

Your Rhombus API key. Must be accompanied by the x-auth-scheme header set to api-token (or partner-api-token for partner endpoints).

Authorizationstringheader

Instead of an API key, an OAuth access token: Bearer <token>, with the read, write, physical scopes.

OAuth explains tokens and scopes.

Headers

x-auth-schemeenum<string>headerdefault: partner-api-token

Authentication scheme identifier. Use api-token or partner-api-token with the x-auth-apikey header, api or partner-api with x-auth-apikey plus a client certificate, api-oauth-token or partner-api-oauth-token with x-auth-access-token, and federated-token with x-auth-ft. A request with Authorization: Bearer <token> and no x-auth-scheme is treated as OAuth, and federated-token may also be sent as the x-auth-scheme and x-auth-ft query parameters.

Available options: api-token, api, api-oauth-token, federated-token, partner-api-token, partner-api, partner-api-oauth-token

x-auth-orgstring<RUUID>header

Client organization UUID (22-character RUUID), for partner credentials only. With it the call runs in that client organization with the partner support authority's role. Without it a partner credential runs as the partner organization, which outside the partner endpoints is deprecated (responses carry Deprecation and Sunset: Tue, 05 Jan 2027 00:00:00 GMT). A malformed value returns 400 INVALID_AUTH_ORG; a client organization the partner cannot access returns 403 PARTNER_CLIENT_ACCESS_DENIED.

Length: 22 to 22

Body

application/json · object

Request object for submitting an API token application.

authTypeenum<string>body

Authentication type for the API token

Available options: API_TOKEN, CERT

csrstring | nullbody

Certificate Signing Request (CSR) for token authentication

Example: "-----BEGIN CERTIFICATE REQUEST-----..."

displayNamestring | nullbody

Display name for the API token

Example: "Production API Token"

expiresAtMsinteger<int64> | nullbody

When the token expires, in epoch milliseconds. Optional for console, mobile and OAuth callers (no expiry). Required when an API token makes the call: no later than that token's own expiry and at most 365 days from now.

permissionGroupUuidstring<RUUID> | nullbodyrequired

base 64 (url-safe) uuid string

Example: "AAAAAAAAAAAAAAAAAAAAAA"

bash

curl --request POST \
  --url 'https://api2.rhombussystems.com/api/partner/submitApiTokenApplication' \
  --header 'x-auth-scheme: partner-api-token' \
  --header 'x-auth-apikey: YOUR_API_KEY' \
  --header 'Content-Type: application/json' \
  --data '{
    "authType": "API_TOKEN",
    "csr": "-----BEGIN CERTIFICATE REQUEST-----...",
    "displayName": "Production API Token",
    "expiresAtMs": 0,
    "permissionGroupUuid": "AAAAAAAAAAAAAAAAAAAAAA"
  }'

import requests

url = "https://api2.rhombussystems.com/api/partner/submitApiTokenApplication"
headers = {
    "x-auth-scheme": "partner-api-token",
    "x-auth-apikey": "YOUR_API_KEY",
    "Content-Type": "application/json",
}
payload = {
    "authType": "API_TOKEN",
    "csr": "-----BEGIN CERTIFICATE REQUEST-----...",
    "displayName": "Production API Token",
    "expiresAtMs": 0,
    "permissionGroupUuid": "AAAAAAAAAAAAAAAAAAAAAA"
}

response = requests.post(url, headers=headers, json=payload)
response.raise_for_status()
print(response.json())

const response = await fetch('https://api2.rhombussystems.com/api/partner/submitApiTokenApplication', {
  method: 'POST',
  headers: {
    'x-auth-scheme': 'partner-api-token',
    'x-auth-apikey': 'YOUR_API_KEY',
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    "authType": "API_TOKEN",
    "csr": "-----BEGIN CERTIFICATE REQUEST-----...",
    "displayName": "Production API Token",
    "expiresAtMs": 0,
    "permissionGroupUuid": "AAAAAAAAAAAAAAAAAAAAAA"
  }),
});
if (!response.ok) throw new Error(`${response.status}: ${await response.text()}`);

console.log(await response.json());

import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;

public class Example {
    public static void main(String[] args) throws Exception {
        String body = """
            {
              "authType": "API_TOKEN",
              "csr": "-----BEGIN CERTIFICATE REQUEST-----...",
              "displayName": "Production API Token",
              "expiresAtMs": 0,
              "permissionGroupUuid": "AAAAAAAAAAAAAAAAAAAAAA"
            }
            """;
        HttpRequest request = HttpRequest.newBuilder()
            .uri(URI.create("https://api2.rhombussystems.com/api/partner/submitApiTokenApplication"))
            .header("x-auth-scheme", "partner-api-token")
            .header("x-auth-apikey", "YOUR_API_KEY")
            .header("Content-Type", "application/json")
            .method("POST", HttpRequest.BodyPublishers.ofString(body))
            .build();
        HttpResponse<String> response = HttpClient.newHttpClient()
            .send(request, HttpResponse.BodyHandlers.ofString());
        System.out.println(response.statusCode() + " " + response.body());
    }
}

json

{
  "apiKey": "AAAAAAAAAAAAAAAAAAAAAA",
  "cert": "<string>",
  "certNotAfterMs": 0,
  "error": false,
  "errorCode": "<string>",
  "expiresAtMs": 0,
  "tokenUuid": "AAAAAAAAAAAAAAAAAAAAAA",
  "validCSR": true
}

Response

200 OK

application/json · object

apiKeystring<RUUID> | null

base 64 (url-safe) uuid string

Example: "AAAAAAAAAAAAAAAAAAAAAA"

certstring | null

certNotAfterMsinteger<int64> | null

When the client certificate expires, in epoch milliseconds (certificate tokens only)

errorboolean | null

errorCodestring | null

Stable, machine-readable code for the failure (one of the ApiErrorCode catalog) when error is true. Branch on this, not on errorMsg.

errorMsgstring | null

expiresAtMsinteger<int64> | null

When the new token expires, in epoch milliseconds. Absent when it does not expire.

tokenUuidstring<RUUID> | null

base 64 (url-safe) uuid string

Example: "AAAAAAAAAAAAAAAAAAAAAA"

validCSRboolean | null

warningMsgstring | null

Errors

Like every operation, this one can also answer with the standard error body (errorCode, errorMsg). Errors explains each status and how to retry.

400 Bad Request. errorCode is one of: BAD_REQUEST, VALIDATION_FAILED, MISSING_REQUIRED_FIELD, INVALID_JSON, INVALID_REQUEST_BODY, FEATURE_NOT_ENABLED, INVALID_AUTH_ORG, LOCATION_NOT_FOUND.
401 Unauthorized. errorCode is one of: UNAUTHENTICATED, INVALID_CREDENTIAL, CREDENTIAL_EXPIRED, CREDENTIAL_REVOKED, CERTIFICATE_MISMATCH.
403 Forbidden. errorCode is one of: FORBIDDEN, DOMAIN_NOT_ALLOWED, DEVICE_SCOPE_MISMATCH, ROLE_NOT_PERMITTED, FUNCTIONALITY_REQUIRED, PARTNER_FUNCTIONALITY_REQUIRED, PERMISSION_REQUIRED, PARTNER_CLIENT_ACCESS_DENIED, HARDWARE_NOT_AVAILABLE, HARDWARE_ALREADY_REGISTERED, PARTNER_PORTAL_NOT_ENABLED, MANAGED_BY_MSP, SUPER_ADMIN_RESTRICTED_BY_MSP, MSP_DESIGNATION_INVALID, NOT_MANAGED_CLIENT.
429 Too Many Requests. errorCode is one of: RATE_LIMITED.
500 Internal Server Error. errorCode is one of: INTERNAL_ERROR.
503 Service Unavailable. errorCode is one of: SERVICE_UNAVAILABLE.