Authentication

The API uses bearer tokens. You get a token by logging in as an iotoms user of the merchant you are integrating with, then send it in the Authorization header.

1. Log inCopy Anchor Link

Send the username and password, and the merchant's tenant code in X-TenantID.

curl -X POST 'https://beta.iotoms.com/api/v1/auth/authenticate' \
  -H 'X-TenantID: <tenant-code>' \
  -H 'Content-Type: application/json' \
  -d '{
    "username": "integration@example.com",
    "password": "••••••••"
  }'

A successful login returns the token:

{
  "token": "eyJ…"
}

Unlike most endpoints, this response has no envelope — the token sits at the top level.

2. Call any endpointCopy Anchor Link

Send the token as a bearer token, together with the same tenant code:

curl 'https://beta.iotoms.com/api/v1/procurement/vendors?page=0&size=20' \
  -H 'X-TenantID: <tenant-code>' \
  -H 'Authorization: Bearer <token>'

3. When the token stops workingCopy Anchor Link

Reuse the same token for all your calls. When a call returns 401 Unauthorized, log in again to get a fresh token and retry.

Trying calls in this referenceCopy Anchor Link

Every endpoint page has Try in Playground. Paste your token into the Authorization field and your tenant code into X-TenantID, fill in the parameters and send — the request goes to the beta environment and you see the live response.