Every API request carries a short-lived Bearer token generated on the Swagger API page.
The token carries your own roles, so you can reach only what you can reach in the portal.
In the CodeSign Secure portal, select Swagger API in the header bar.
At the top of the page, select Generate a Bearer token. The token opens in a new tab.
Copy the token, select Authorize, and enter Bearer <your token>.
Use Try it out on any endpoint, or send the same token from your own scripts.
Send the token in the Authorization header of every request:
Authorization: Bearer <your token>
Note: Signing endpoints also require your client authentication certificate, so they can’t be called from the Swagger page. Each one shows a ready-made curl command on the Swagger page. See Securing API Access.
| Status code | Meaning | What to do |
|---|---|---|
| 403 | The access token has expired. | Generate a new token on the Swagger API page and retry. |
| 440 | Authentication failed. The Authorization header is missing or malformed, the token is invalid, or its session is no longer active. | Check that the header reads Bearer <your token>, then generate a new token. |
| 460 | The account is locked or has been deleted. | Ask a System Admin to check the account in System Setup > User. |
| 480 | The account’s role does not carry the permission the endpoint requires. | Ask a System Admin to enable the permission for your role, for example API Access. |
All status codes are listed in Request and Response Conventions.