> For the complete documentation index, see [llms.txt](https://docs.securepass.me/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.securepass.me/documentation/api-reference/rest-api-support.md).

# REST API support

SECUREpass exposes REST APIs so that an application can register a user's authentication methods, challenge them and verify the response, without implementing any of those methods itself — and so that non-human callers can be authorised against the same identity model as people.

There is no separate API host and no shared cloud endpoint. Calls are made against your own deployment, and every call is interpreted in the context of a tenant.

| API                         | What it does                                                                          |
| --------------------------- | ------------------------------------------------------------------------------------- |
| **MFA API**                 | Registers a user's authentication method, issues the challenge, verifies the response |
| **Agent authorisation API** | Decides whether a software agent may perform a requested action                       |

## Where the APIs live

Each service owns a context path, and that path is the first part of any URL you call.

| Service     | Context path       | What it serves             |
| ----------- | ------------------ | -------------------------- |
| `sp-spauth` | `/AuthPage`        | Authentication             |
| `sp-admin`  | `/SecurepassAdmin` | Administration             |
| `sp-ss`     | `/Securepass`      | Self-service               |
| `sp-otp`    | `/OTP`             | One-time passwords and MFA |
| `sp-tm`     | `/SPTManager`      | Tenant management          |

In the Docker deployment these run on ports 8080, 8082, 8083, 8084 and 8085 respectively. In production they sit behind a reverse proxy on the published hostname, so identify a service by its context path rather than its port.

Context paths are not identical across environments — the authentication service is reached at `/AuthPage` on the deployment model documented here and at `/SPAuthPage` on the demo environment. Confirm the paths your own deployment uses before building against them.

`/Securepass` is the self-service **API** context. The end-user self-service interface is served at `/SelfService`, which is a different path and not an API.

## Authentication

Access uses the OAuth 2.0 client credentials grant.

```
POST /SPAuthPage/oauth/token/{tenantId}
```

The request takes `grant_type`, `client_id` and `client_secret`. The response carries `access_token`, `token_type`, `expires_in` and `scope`. Pass the token as a bearer token on every other call.

Tokens are short-lived — `expires_in` is 600 seconds — so a caller that runs for any length of time must request a new one rather than holding the first. Treat the client secret the way you would a password: it belongs in a secret store, not in source control or a shared collection.