> ## Documentation Index
> Fetch the complete documentation index at: https://docs.sphinxhq.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Get Access Token

> Exchange client_id + client_secret for a short-lived Bearer access token. Use the returned `access_token` in the `Authorization: Bearer <token>` header for all other endpoints.



## OpenAPI

````yaml /api_schema.yaml post /api/oauth/token/
openapi: 3.0.3
info:
  title: Sphinx API
  version: 1.0.0
  description: >
    Automated compliance API for KYC/AML workflows. Sphinx handles PEP
    screening, sanctions checks, adverse media monitoring, and document
    verification with AI-powered decisions.


    **Quick Start:**

    1. **Upload Documents** (Optional) - Required for KYB, KYC EDD, and
    transaction monitoring. Not required for AML checks (PEP, Sanctions, Adverse
    Media).

    2. **Create a Case** - The case creation endpoint combines customer details
    and checks (typically a single alert) into one request.

    3. **Receive Webhook** - Results are sent to your webhook URL when
    processing completes.


    **Authentication:** All API requests require a bearer token. Include it in
    the Authorization header: `Authorization: Token <YOUR_API_KEY>`


    **Outcomes:** Each check returns an outcome (ACCEPTED, REJECTED, or PENDING)
    with detailed reasoning, risk scores (0.0-1.0), and audit-ready case notes
    in Markdown format.


    For detailed documentation, visit
    [docs.sphinxhq.com](https://docs.sphinxhq.com).
servers:
  - url: https://app.sphinxhq.com
    description: Production server (US)
  - url: https://eu.sphinxhq.com
    description: Production server (EU)
security: []
tags:
  - name: Cases
    description: >-
      Cases represent compliance reviews for a customer. Create a case, add
      checks, then start processing.
  - name: Checks
    description: >-
      Individual compliance checks within a case (e.g., PEP, Sanctions, Document
      Verification).
  - name: Customers
    description: >-
      Customer records linked to cases. Store customer details, type
      (individual/company), and external IDs.
  - name: Documents
    description: >-
      Upload and manage documents for cases and checks. Used for identity
      verification and document-based checks.


      **Allowed file types:** PDF, PNG, JPG, CSV, XLSX, DOCX, MD.
  - name: Events
    description: >-
      Timeline of activity on cases and checks: comments, outcome changes,
      assignments, status changes, reruns, and document activity.
paths:
  /api/oauth/token/:
    post:
      tags:
        - oauth
      summary: Get Access Token
      description: >-
        Exchange client_id + client_secret for a short-lived Bearer access
        token. Use the returned `access_token` in the `Authorization: Bearer
        <token>` header for all other endpoints.
      operationId: oauth_token_create
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/OAuthTokenRequest'
            examples:
              ClientCredentials:
                value:
                  client_id: 00000000-0000-0000-0000-000000000000
                  client_secret: your-client-secret
                  grant_type: client_credentials
                summary: Client credentials
          application/x-www-form-urlencoded:
            schema:
              $ref: '#/components/schemas/OAuthTokenRequest'
          multipart/form-data:
            schema:
              $ref: '#/components/schemas/OAuthTokenRequest'
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OAuthTokenResponse'
          description: ''
      security:
        - tokenAuth: []
        - {}
components:
  schemas:
    OAuthTokenRequest:
      type: object
      properties:
        client_id:
          type: string
          format: uuid
        client_secret:
          type: string
        grant_type:
          enum:
            - client_credentials
          type: string
          description: '* `client_credentials` - client_credentials'
          x-spec-enum-id: 524e932a3a75412a
      required:
        - client_id
        - client_secret
        - grant_type
    OAuthTokenResponse:
      type: object
      properties:
        access_token:
          type: string
        token_type:
          type: string
        expires_in:
          type: integer
      required:
        - access_token
        - expires_in
        - token_type
  securitySchemes:
    tokenAuth:
      type: http
      scheme: bearer

````