In addition to standard HTTP authentication, where the username and password are sent with every request, ABRA Flexi can issue an authentication token. This token is then attached to subsequent calls instead of the password.
Obtaining a token
POST /login-logout/login.json
Content-Type: application/x-www-form-urlencoded
username=jmeno&password=heslo
The data is sent as form data (application/x-www-form-urlencoded or multipart/form-data), not as JSON. If the account requires a one-time password, the otp field is added as well.
The response is JSON containing the token:
{"success":true,"authSessionId":"ef6911bb…","refreshToken":"4f133f49-…","csrfToken":"cd174186-…"}
For an incorrect username or password:
{"success":false,"errors":{"reason":"Bylo zadáno chybné uživatelské jméno či heslo.","messageCode":"loginDialogNeplatneJmenoNeboHeslo"}}
Using the token
The token can be passed in three ways:
Method | Syntax |
HTTP header |
|
Cookie |
|
URL parameter |
|
⚠️ Use the URL variant only in exceptional cases — authentication credentials get written to server logs. The header is the safer option.
ℹ️ The session needs to be kept alive by occasionally calling GET /login-logout/session-keep-alive.js. If it expires, the server will start responding to requests with a redirect to /login-logout/remote-logout — in that case you'll need to log in again.
Generating in Postman
The token can, of course, also be obtained from a graphical client:
Note: If you previously set up standard authentication on the Auth tab in Postman, you need to clear those credentials.