Authentication & errors

Authentication

Every request — other than health checks and the internal service callbacks — is authenticated with a bearer token, presented as an Authorization header:

Authorization: Bearer <your-osc-access-token>

In production on OSC, this is enforced by the platform's login wall in front of the instance. The token is your OSC Personal Access Token — the same one used in Installation to deploy the instance.

Errors & conventions

• Standard HTTP status codes: 2xx success, 4xx client error (bad input, not found), 5xx server/upstream error.
• Long-running work (transcode, package, provisioning) is asynchronous: the triggering call returns immediately with a job or operation id, which you poll via the corresponding GET endpoint — see Introduction → synchronous vs. asynchronous work.
• Trailing slash. Each collection root (for example POST /api/v1/assets) is served both with and without a trailing slash — both reach the same handler.
• Endpoints under Internal callbacks are called by the transcoder and packager services as callbacks and are not part of the public client contract.