Qubiclo uses RS256 JWT-based authentication. All API requests require a valid access token with appropriate tenant-scoped permissions.
1. Login
POST /auth/login with email and password to receive access and refresh tokens
2. Make API Requests
Include Bearer token in Authorization header for all API calls
3. Refresh Token
Use refresh token (via cookie or body) to obtain new access token before expiration (900s)
4. Logout
POST /auth/logout to invalidate the session and clear the refresh cookie
/auth/logincurl -X POST http://localhost:8000/api/v1/auth/login \
-H "Content-Type: application/json" \
-d '{
"email": "admin@yourhmo.com",
"password": "your_password"
}'Response:
{
"access_token": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...",
"expires_in": 900,
"token_type": "bearer"
}Access tokens expire after 900 seconds. Use the refresh cookie (set automatically on login) or pass it explicitly to get a new access token.
/auth/refreshcurl -X POST http://localhost:8000/api/v1/auth/refresh \
-H "Content-Type: application/json" \
--cookie "qubiclo_refresh_token=YOUR_REFRESH_TOKEN"| Scope | Description |
|---|---|
| claims:write | Submit and update claims |
| claims:read | Read claim data and status |
| fraud:read | Access fraud analysis results |
| uploads:write | Upload supporting documents |
| providers:write | Manage provider contracts |
| providers:read | View provider data |
| rulebooks:write | Create and publish rulebooks |
| rulebooks:read | View rulebook configurations |
| workflow:manage | Claim and transition review tasks |
| audit:read | Access audit logs and compliance data |
| tenant:configure | Manage tenant settings and users |