## OAuth implementation reference

The following query parameters are passed during the HTTPS flow to obtain an access token or a refresh token for web service calls.

See Getting an OAuth access token from the authorization code.

Table:

Parameter | Value
--- | ---
client_id | The client identifier that is provided when the administrator registers the remote management application Registration is required to obtain the client_id.
client_secret | The client secret that is provided when the administrator registers the remote management application
response_type | Must be code.
redirect_uri | https://host_name:port_number/sepm If you redirect to the client application, we recommend this URI. If your application redirects to a web server, for example, the server must handle the exchange with the Symantec Endpoint Protection Manager server properly.
code | The authorization code that is generated by Symantec Endpoint Protection Manager when the administrator authorizes the client application to access the web services.
grant_type | Must be set to authorization_code when the first request for an access token is made Must be set to refresh_token to request a new access token from a refresh token
access_token | The access token that was issued by Symantec Endpoint Protection Manager
token_type | Must be bearer
refresh_token | The refresh token that was issued by Symantec Endpoint Protection Manager together with the access token

See Using OAuth with Symantec Endpoint Protection Manager web services.