Authentication and Tokens

Every endpoint in the IZO™+ Multi Cloud Connect API is protected. Each request must carry a JSON Web Token (JWT) in the HTTP Authorization header using the Bearer scheme: Authorization: Bearer <token>. A missing, malformed, or expired token returns 401.

Authentication scheme

The API uses a single security scheme: HTTP Bearer authentication with a JWT. The token is issued by your identity provider or API gateway and presented on every request. There are no endpoints that accept anonymous (unauthenticated) access.

Sending the token

Add the Authorization header to every request, with the value Bearer followed by your token:

curl -X POST "https://api.tatacommunications.com/gnsapi/izomcc/v1/geo" \
  -H "Authorization: Bearer eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9..." \
  -H "Content-Type: application/json" \
  -d '{
        "product": "CloudConnect",
        "legalEntityId": "8501",
        "emailId": "customer@example.com",
        "dataCenterLocation": { "mccFlavour": "Direct" }
      }'

The same header applies to every endpoint, whether it is a GET, POST, PUT, or DELETE.

Obtaining a token

Tokens are issued by your identity or API gateway, not by the IZO™+ Multi Cloud Connect API itself. The credentials and issuing endpoint are provisioned as part of your API onboarding.

When authentication fails

If the token is absent, malformed, or expired, the API returns HTTP 401. The response body is an authentication-challenge object, for example:

{
"faultcode": "Server",
"faultstring": "Authentication challenge issued"
}

Your integration should treat any 401 as a signal to obtain a fresh token and retry the request once, rather than retrying with the same token.

Access scope

The data you can see and act on is tied to the legal entity you are authorised for. Most read endpoints take a legalEntityId (or a quoteCode that belongs to your entity), and the API returns only the records that belong to that entity.

Good practice

Always use HTTPS. The API is served only over TLS; never send a token over plain HTTP.
Keep tokens out of source control and logs. Treat the bearer token as a secret.
Send the token on every call. There is no session cookie; each request is authenticated independently.
Handle expiry gracefully. Detect 401, obtain a fresh token, and retry once.