Authentication

The Docmation External API uses bearer-token authentication. You exchange a long-lived API key plus API secret for a short-lived JWT, then send that JWT on every subsequent request.

Step 1 — request a JWT

POST /api/Login/Authenticate

curl -X POST https://api.docmation.eu/api/Login/Authenticate \
  -H "Content-Type: application/json" \
  -d '{
    "apiKey": "<your-api-key>",
    "secret": "<your-api-secret>"
  }'

Response:

{
  "bearerToken": "eyJhbGciOi...",
  "expires": "2026-06-04T15:00:00Z"
}

Step 2 — call any endpoint

Send the JWT as a Bearer token:

curl https://api.docmation.eu/api/VlmMad/Ping \
  -H "Authorization: Bearer eyJhbGciOi..."

Token lifetime

JWTs are short-lived (~20 minutes). Re-authenticate when the token expires (or proactively when you see a 401 Unauthorized response). Cache the token until ~30 seconds before expires rather than re-authenticating per request.

Tenant scoping

The JWT carries a CompanyId claim. All queries you make are automatically scoped to that tenant; you cannot read or write data belonging to other tenants with the same credentials.