POST/oauth/token

Public. No key, and no quota deducted.

What it does

Request bodies are application/x-www-form-urlencoded (RFC 6749 §4.1.3 : JSON is not an accepted encoding here and a client sending it gets an honest invalid_request), and every error body is RFC 6749 shaped.

Call it

bash

curl -fsS -X POST "https://api.mapmap.ai/oauth/token" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d @request.json

Request body

application/x-www-form-urlencoded

grant_type=authorization_code&code=…&redirect_uri=…&client_id=…&code_verifier=… or grant_type=refresh_token&refresh_token=…&client_id=…

The OpenAPI document declares this body as a free-form JSON object with no field list, so there is nothing here to generate a table from. The prose above is what the gateway states about it; the raw document is the authority.

Responses

200Access/refresh pair

400RFC 6749 error object (invalid_request, invalid_grant, invalid_client, unsupported_grant_type); never problem+json

Error bodies follow the shared problem model documented on API conventions.

Also under oauth

GET /.well-known/oauth-authorization-server POST /oauth/authorize/grant POST /oauth/register

Generated from https://api.mapmap.ai/openapi.json on 2026-09-17 · operationId token