Security Handshake¶

All endpoints that can mutate the database require a header of Authorization: Bearer <jwt_token>. You can obtain a JWT token by submitting a POST /auth request such as the following:

POST /anno/v1/auth
Authorization: APIKEY <your_api_key>

Example using curl:

curl -X 'POST' \
  'http:/myserver.org/anno/v1/auth' \
  -H 'Authorization: APIKEY <your_api_key>'

Security flow diagram¶

sequenceDiagram actor U as User participant A as Annosaurus U->>+A: GET /auth activate A Note right of A: Authorization: APIKEY <your api key> A-->>U: {..., "access_token": <jwt> } deactivate A U->>+A: POST/DELETE/PUT activate A Note right of A: Authorization: Bearer <jwt> A-->>U: Success reponse 20x deactivate A