# Authorization: Bimp API methods

URL: https://bimpsoft.com/en/help/developers/api-reference/auth/

Bimp API methods for the “Authorization” resource (`/org2/auth/…`): 4 methods. Base URL: `https://app.bimpsoft.com`. All requests except login pass the company token in the `access-token` header — see [Getting started with the API](/en/help/developers/api-getting-started/).

| Method | What it does |
|---|---|
| [`POST /org2/auth/api-login`](#api-login) | Allows you to obtain a basic user token for further requests that do not depend on a specific company |
| [`POST /org2/auth/api-refresh`](#api-refresh) | Allows you to extend the user session by refreshing the token without the need for re-authorization |
| [`POST /org2/auth/api-selectCompany`](#api-select-company) | Allows you to generate a new access token containing information about the selected company. This token can be used to access the company's data (e.g., user list or product balances). |
| [`POST /org2/auth/api-verifyCompanyAccess`](#api-verify-company-access) | Validates a company access token and returns the associated auth payload for use by microservices. |

## api-login

`POST /org2/auth/api-login`

Allows you to obtain a basic user token for further requests that do not depend on a specific company

**Request body (JSON)**

| Field | Type | Required | Description |
|---|---|---|---|
| `email` | string (email) | yes | The email address of the user, must be a valid email format |
| `password` | string | yes | The password for the user |

**Response: `data` field**

| Field | Type | Description |
|---|---|---|
| `accessToken` | string | The access token used to authenticate the user for subsequent requests |
| `refreshToken` | string | The refresh token used to obtain a new access token when the current one expires |

```bash
curl -X POST 'https://app.bimpsoft.com/org2/auth/api-login' \
  -H 'Content-Type: application/json' \
  -d '{"email":"api-user@example.com","password":"string"}'
```

## api-refresh

`POST /org2/auth/api-refresh`

Allows you to extend the user session by refreshing the token without the need for re-authorization

**Request body (JSON)**

| Field | Type | Required | Description |
|---|---|---|---|
| `refreshToken` | string | yes | The refresh token used to obtain a new access token |

**Response: `data` field**

| Field | Type | Description |
|---|---|---|
| `accessToken` | string | The access token used to authenticate the user for subsequent requests |
| `refreshToken` | string | The refresh token used to obtain a new access token when the current one expires |

```bash
curl -X POST 'https://app.bimpsoft.com/org2/auth/api-refresh' \
  -H 'access-token: <company token>' \
  -H 'Content-Type: application/json' \
  -d '{"refreshToken":"string"}'
```

## api-selectCompany

`POST /org2/auth/api-selectCompany`

Allows you to generate a new access token containing information about the selected company. This token can be used to access the company's data (e.g., user list or product balances).

**Response: `data` field**

| Field | Type | Description |
|---|---|---|
| `companyAccessToken` | string | The access token for the company, used for authentication |

```bash
curl -X POST 'https://app.bimpsoft.com/org2/auth/api-selectCompany' \
  -H 'access-token: <company token>' \
  -H 'Content-Type: application/json' \
  -d '"string"'
```

## api-verifyCompanyAccess

`POST /org2/auth/api-verifyCompanyAccess`

Validates a company access token and returns the associated auth payload for use by microservices.

```bash
curl -X POST 'https://app.bimpsoft.com/org2/auth/api-verifyCompanyAccess' \
  -H 'access-token: <company token>'
```

Interactive documentation with a test request option: [https://app.bimpsoft.com/docs](https://app.bimpsoft.com/docs). The OpenAPI specification is updated together with Bimp; this page is generated from it automatically.