Getting started

Go from your API credentials to a first authenticated response in three steps: get a token, call the API, and confirm the 200.

Before you begin

You need a set of API credentials issued by Trailblazer:

• Client ID and Client secret — an OAuth2 client_credentials app client. Treat the secret like a password; keep it on a server, never in a browser or mobile app or checked into source control.

These examples use the UAT environment. The API base is https://api.uat.trailblazertech.com and the OAuth2 token endpoint is https://auth.uat.trailblazertech.com/oauth2/token. (For production, swap in https://api.trailblazertech.com and https://auth.trailblazertech.com/oauth2/token.)

1. Get an access token

   Exchange your client credentials for a short-lived bearer token. Send the credentials with HTTP Basic auth and request the access scope for your environment.

   curl -X POST https://auth.uat.trailblazertech.com/oauth2/token \
     -u "$CLIENT_ID:$CLIENT_SECRET" \
     -H "Content-Type: application/x-www-form-urlencoded" \
     -d "grant_type=client_credentials" \
     -d "scope=api.uat.trailblazertech.com/access"

   The response contains the token:

   {
     "access_token": "eyJraWQ...",
     "expires_in": 3600,
     "token_type": "Bearer"
   }

   The access scope is environment-specific. On UAT it is api.uat.trailblazertech.com/access; in production it is api.trailblazertech.com/access. Requesting the wrong environment's scope will cause your API calls to be rejected. See Authentication for how scopes work.

2. Make your first authenticated call

   Send the token as a Bearer credential in the Authorization header. GET /v1/health is the simplest endpoint to verify your setup — it echoes back who you are.

   curl https://api.uat.trailblazertech.com/v1/health \
     -H "Authorization: Bearer $ACCESS_TOKEN"

3. Confirm the response

   A successful call returns 200 OK with a small identity echo:

   {
     "status": "ok",
     "tenant": "acme",
     "partnerId": "pty_example",
     "principalId": null
   }

   tenant and partnerId reflect the account your credentials are bound to. principalId is null unless you sent an x-principal-id header (see Authentication). If you got a 200 here, your credentials, token, and network path all work.

Try it in the browser

The API reference has a built-in "Try it" console. Open the reference, expand an operation, and use the Authentication panel to enter your Client ID and Client secret for the client_credentials flow — the console fetches a token for you and calls the API directly from the page.

Next steps

• Authentication — scopes, token lifetime, and the x-principal-id header.
• Async mutations — how to submit new-business intakes and track the job to completion.
• Errors — the error envelope and what each code means.
• API reference — every endpoint and schema.