Actuarial Certificate — Authentication

The Actuarial Certificate callback endpoints are protected by OAuth 2.0 using the Resource Owner Password Flow with Bearer tokens.

Every request your system makes to a Class callback endpoint must include a valid bearer token in the Authorization header. The token must belong to the provider login account Class set up for you, which carries a special role required to call these endpoints.

There are two authentication directions in this integration:

Provider → Class (covered here) — always OAuth password grant, described below.
Class → Provider (the initial request) — agreed per provider during onboarding; see Registration.

Credentials you need

Credential	Where it comes from
Client ID	Provided by Class during registration. Different per environment.
Client Secret	Provided by Class during registration. Different per environment.
Provider login (username)	The Class user account set up for your integration during registration.
Provider login password	The password for that account.

Requesting a token

Make a POST to the token endpoint. Note the token endpoint is on the app host, not the apigateway host.

Environment	Token URL
PIE (Sandbox)	`https://app.class-pie.com.au/connect/token`
Production	`https://app.class.com.au/connect/token`

Example request — Content-Type: application/x-www-form-urlencoded:

POST /connect/token HTTP/1.1
Host: app.class-pie.com.au
Content-Type: application/x-www-form-urlencoded

grant_type=password
&client_id=your-client-id
&client_secret=your-client-secret
&username=your-provider-login
&password=your-provider-login-password

Example response:

{
    "access_token": "eyJhbGciOiJSUzI1NiIsInR5cCI6...",
    "expires_in": 900,
    "token_type": "Bearer",
    "scope": "fund.read"
}

Using the token

Attach the token as a Bearer token in the Authorization header of every callback request:

POST /api/1.0/c/service-provider/{providerId}/actuary/certificate-request/{requestId}/status HTTP/1.1
Host: apigateway.class-pie.com.au
Authorization: Bearer eyJhbGciOiJSUzI1NiIsInR5cCI6...
Content-Type: application/json

{ ... }

Scope

The certificate endpoints require the fund.read scope. Although creating and updating a status are write operations, access is granted through the provider login's role rather than a maintain scope, so fund.read is sufficient.

Token lifespan

Access tokens are valid for 15 minutes (expires_in: 900).
After expiry, request a new token using the same password flow.
Refresh tokens are not issued for this flow.