> ## Documentation Index
> Fetch the complete documentation index at: https://docs.thingidentity.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Introduction

> Base URL, media types and status codes shared by every endpoint.

## Base URL

```
https://api.thingidentity.com
```

Every endpoint is served over HTTPS, and every example in these docs uses this host.

## Authentication

Every endpoint except [`POST /oauth/token`](/api-reference/endpoints/get-an-access-token) expects a
bearer token:

```
Authorization: Bearer <access_token>
```

Tokens come from the client credentials grant and last an hour. See
[Authentication](/guides/authentication) for how to create an API client and what its scopes mean.

## Media types

The API is versioned through a vendor media type.

| Header         | Value                                                              | Applies to           |
| -------------- | ------------------------------------------------------------------ | -------------------- |
| `Accept`       | `application/vnd.thingidentity.public.v1+json`, `application/json` | Public API endpoints |
| `Content-Type` | `application/vnd.thingidentity.public.v1+json`, `application/json` | JSON request bodies  |
| `Content-Type` | `application/x-www-form-urlencoded`                                | `/oauth/token`       |

For convenience, `application/json` is also accepted and maps to the latest version of an endpoint.
For production integrations, sending the versioned media type is recommended.

## Status codes

| Status                      | Meaning                                                                                                                                        |
| --------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------- |
| `200 OK`                    | Request handled.                                                                                                                               |
| `400 Bad Request`           | Malformed request, or an unsupported `grant_type` on the token endpoint.                                                                       |
| `401 Unauthorized`          | Missing, malformed, expired or revoked credentials.                                                                                            |
| `403 Forbidden`             | Valid token without the required scope, a token used on an endpoint it is not allowed on, or a subscription that no longer covers API clients. |
| `404 Not Found`             | Unknown resource.                                                                                                                              |
| `406 Not Acceptable`        | The `Accept` header names no media type this endpoint produces.                                                                                |
| `409 Conflict`              | The request collides with existing data.                                                                                                       |
| `422 Unprocessable Content` | The request shape is valid but the content is not.                                                                                             |
| `500 Internal Server Error` | Our fault. Safe to retry a read; retry a write only if you can tolerate a duplicate.                                                           |

How failure bodies are shaped is covered in [Error handling](/api-reference/errors).