> For the complete documentation index, see [llms.txt](https://rest-api.symphony.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://rest-api.symphony.com/main/content-export-files/oauth2-authenticate.md).

# OAuth2 Authenticate

Released in 20.13. Authenticates the API caller on the Symphony servers (pod) using a Session token, and returns a valid OAuth2 access token.

{% hint style="info" %}
Use scope '**sym-files**' in order get access to the Content Export Files endpoints.

Permission required: **Content Export Reader** role.
{% endhint %}

## Returns a valid OAuth2 access token from a given session token

> Used to interact with the File Management endpoints. \*\*Required Role:\*\* Your Service Account must have the \*\*Content Export Reader\*\* role.<br>

```json
{"openapi":"3.0.3","info":{"title":"File Management API","version":"1.0.1"},"tags":[{"name":"Authentication","description":"Operations related to identity and token management."}],"servers":[{"url":"https://{vanity}.symphony.com","description":"Symphony provided tenant URL","variables":{"vanity":{"description":"Customer ID assigned by the service provider","default":"yourpodURL"}}}],"security":[],"paths":{"/login/idm/tokens":{"post":{"tags":["Authentication"],"summary":"Returns a valid OAuth2 access token from a given session token","description":"Used to interact with the File Management endpoints. **Required Role:** Your Service Account must have the **Content Export Reader** role.\n","operationId":"getAccessToken","parameters":[{"name":"sessionToken","in":"header","description":"User session authentication token","required":true,"schema":{"type":"string"}},{"name":"scope","in":"query","description":"Optional field used to get access with specific entitlements, use space separated list to define more than one.\nUse scope 'sym-files' in order get access to the Content Export Files endpoints.\n","required":false,"schema":{"type":"string"}}],"responses":{"200":{"description":"OK.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/JwtToken"}}}},"401":{"description":"Client is unauthorized to access this resource","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AuthErr"}}}},"403":{"description":"Forbidden to access this endpoint.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AuthErr"}}}},"500":{"description":"Server error, see response body for further details.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AuthErr"}}}}}}}},"components":{"schemas":{"JwtToken":{"type":"object","properties":{"token_type":{"type":"string","description":"Type of token, string \"Bearer\""},"expires_in":{"type":"integer","format":"int64","description":"Duration of time the access token is granted for in seconds"},"access_token":{"type":"string","description":"A JWT containing the caller's username or application, an expiration date and a set of entitlements related to the specified scope.\n"}}},"AuthErr":{"type":"object","properties":{"code":{"type":"integer","format":"int32"},"message":{"type":"string"}}}}}}
```