Authentication

How can I authenticate in Elyssa App to use the API?

To authenticate on each endpoint is very simple. Just insert you token on the "Authorization" header and x-company-id

Example

  'headers': {
    'Content-Type': 'application/json',
    'Authorization': 'Bearer c7f35c84-7893-4087-b4fb-d1f06c23',
    'x-company-id': '<company_id>'
  },

Get authorization token

This endpoint is used to authenticate the company. Upon successful execution, it returns a status code of 200 along with a token in the response body.

Create token

POST {{url_base}}/auth/token

This endpoint is used to authenticate company on Elyssa App and return token to use API. The token it's validate for one month after created token, after that time, you need use refresh token to generate a new token. If the company does't have an active plan in ElyssaApp, both the token and refresh token will remain inactive.

The Token is valid for one month after its creation.

The refresh token it's validate for 360 days.

Request Body

Name	Type
companyId*	String
nit*	String

200: OK Authentication token

{
  "data": {
    "accessToken": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJjb22wYW55SWQiOiJiOTRlNDA2Ny0yN2M4LTRhMTQtOGMxZS1jNzAxMzNjYzczYzUiLCJjb21wYW55TmFtZSI6IkVseXNzYSBBcHAgLSBUZXN0IGNvbXBhbnkiLCJleHAiOjE3ODg4MDA2MTYsImlzcyI6IkJhY2tPZmZpY2VFbHlzc2EiLCJhdWQiOiJFbHlzc2FBcHAifQ.7AZLYbhl0nrb7TJ6LNYcX0COWSUgkm486Pk52Yf__-M",
    "refreshToken": "0xTnrH8STws+4hyF4OGJbJsNBLfZDhCocvWm0UTKrjQ4zxVSyyhoxdxLiRBtTAkUQde4eQwPbYaJg/rGg6mSdg==",
    "expiresIn": 2592000,
    "tokenType": "Bearer"
  },
  "success": true,
  "timestamp": "2026-08-08T17:03:37.5560238Z"
}

401: Unauthorized

{
  "success": false,
  "error": {
    "code": "string",
    "message": "string",
    "details": "string",
    "field": "string"
  },
  "timestamp": "2026-08-08T17:48:17.748Z"
}

If you try to access any endpoint without entering the "Authorization" header, or enter an invalid api_token, you will receive a response with status 401 (Unauthorized).

Refresh Token

POST {{url_base}}/auth/refresh

This endpoint is used to authenticate and generate a new token

Request Body

Name	Type
refresh*	String

200: OK Authentication token

{
  "data": {
    "accessToken": "eyJhbGciOiJIUzI1NiIsInR5cCI8IkpXVCJ9.eyJjb22wYW55SWQiOiJiOTRlNDA2Ny0yN2M4LTRhMTQtOGMxZS1jNzAxMzNjYzczYzUiLCJjb21wYW55TmFtZSI6IkVseXNzYSBBcHAgLSBUZXN0IGNvbXBhbnkiLCJleHAiOjE3ODg4MDA2MTYsImlzcyI6IkJhY2tPZmZpY2VFbHlzc2EiLCJhdWQiOiJFbHlzc2FBcHAifQ.7AZLYbhl0nrb7TJ6LNYcX0COWSUgkm486Pk52Yf__-M",
    "refreshToken": "0xTnrH8STws+4hyF4OGJbJsNBLfZDhCocvWm0UTKrjQ4zxVSyyhoxdxLiRBtTAkUQde4eQwPbYaJg/rGg6mSdg==",
    "expiresIn": 2592000,
    "tokenType": "Bearer"
  },
  "success": true,
  "timestamp": "2026-08-08T17:03:37.5560238Z"
}

401: Unauthorized

{
  "success": false,
  "error": {
    "code": "string",
    "message": "string",
    "details": "string",
    "field": "string"
  },
  "timestamp": "2026-08-08T17:48:17.748Z"
}