## Including the OAuth token in calls to web services

After an OAuth access token is obtained, it must be included in every call that is made to the Symantec Endpoint Protection web services. The access token and its accompanying refresh token should be cached for reuse. The access token has a lifetime (expiration) of 12 hours. When the access token expires, the refresh token can be used to obtain a new access token. See Refreshing the access token.

You can include the token in an access_token query parameter, as in the following example:

GET https://<hostname>:<port_number>/sepm/ws/v1/LicenseService?access_token=<access_token>

For security reasons, however, we recommend that you include the access token as part of the HTTP header, in the form of Authorization: Bearer.

Example header

    POST http://localhost:8014/sepm/ws/v1/LicenseService HTTP/1.1
    Accept-Encoding: gzip,deflate
    Content-Type: text/xml;charset=UTF-8
    SOAPAction: ""
    Authorization: Bearer access_token
    User-Agent: Jakarta Commons-HttpClient/3.1
    Host: localhost:8014
    Content-Length: 252

See Getting an OAuth access token from the authorization code.

See Using OAuth with Symantec Endpoint Protection Manager web services.

See OAuth implementation reference.

See OAuth flow.