Damoov API Authorization Policies

1. Scope of Access:

• User JWT:
  • Provides access to individual user data.
• Admin JWT:
  • Grants access to all data associated with the company.

2. JWT Acquisition and Refresh Mechanics:

reference: 🛡 Authentication

• Initial JWT and refresh token acquisition is through user authentication service.

curl --request POST \
     --url https://user.telematicssdk.com/v1/Auth/Login \
     --header 'InstanceId: InstanceId' \
     --header 'accept: application/json' \
     --header 'content-type: application/json' \
     --data '
{
  "LoginFields": "{\"Devicetoken\":\"UUID\"}",
  "Password": "InstanceKey"
}
'

curl --request POST \
     --url https://user.telematicssdk.com/v1/Auth/Login \
     --header 'accept: application/json' \
     --header 'content-type: application/json' \
     --data '
{
  "LoginFields": "{\"email\":\"[email protected]\"}",
  "Password": "Password"
}
'

• For token renewal, use the following API request:

curl --request POST
--url https://user.telematicssdk.com/v1/Auth/RefreshToken
--header 'accept: application/json'
--header 'content-type: application/json'
--data '
{
"AccessToken": "YOUR_ACCESS_TOKEN",
"RefreshToken": "YOUR_REFRESH_TOKEN"
}
'

3. Token Revocation:

• To revoke existing JWT and refresh tokens:
  • Re-issue a new one via the initial authorization method.

4. Logging & Monitoring:

• All token usage and unauthorized access attempts are logged.
• Logs retention period is 3 days.

5. API Rate Limits:

• Authorization API:
  • Limited to 5 requests per hour.
• Refresh Token API:
  • No rate limits.

6. Multi-factor Authentication:

• No MFA requirement for the JWT issuance process.

7. Data Protection:

• For token storage on the client-side:
  • Follow best practices to ensure the JWT is stored securely.

8. Token Structure:

• Specific details about the JWT's payload structure and the claims it includes are not disclosed.

9. Error Handling:

• Common errors include:
  • Status 401: For expired tokens.
  • Clients should be aware of other standard HTTP status codes.

10. Endpoint Security:

• All API endpoints are secured by Cloudflare.