DQE One API — Authentication & Session

Authentication & Session - DQE One API

These three endpoints issue and manage the credentials the DQE One Salesforce package uses to call the rest of the One API: a short-lived process token, an organization/user subscription (onboarding) flow, and a session token for the package's custom UI.

Related documentation:

DQE One API — Introduction (authentication model overview, health check)

Jump to getOAuthTokenForProcess subscribe createTokenSession

Process Token - DQE One API

Issues a short-lived token used to authenticate a specific backend process initiated by the Salesforce package.

getOAuthTokenForProcess

Jump to Parameters Response Example Errors ▶ Test the API

Request

Send a JSON body to this endpoint with the DQE-Authorization header set.

{DOMAIN} is the domain of the server where your organization's own instance of the DQE One backend is installed — since this backend runs in your own infrastructure, this value is determined by your deployment, not issued by DQE. {DQE_AUTHORIZATION_KEY} is provided by DQE upon account/package setup; contact your DQE account manager to obtain it.

POSThttps://{DOMAIN}/getOAuthTokenForProcess

Code examples

Request a process token

cURL JavaScript Python PHP Node.js Java C# Go

curl -X POST "https://{DOMAIN}/getOAuthTokenForProcess" \
  -H "DQE-Authorization: {DQE_AUTHORIZATION_KEY}" \
  -H "Content-Type: application/json" \
  -d '{
  "orgId": "00D5e0000008abcEAA",
  "crt": "2026-10-28T10:15:00Z",
  "sub": "0055e00000AbCnoFAF",
  "aud": "dqe-unify-api",
  "urllogin": "https://login.salesforce.com"
}'

fetch("https://{DOMAIN}/getOAuthTokenForProcess", {
  method: "POST",
  headers: {
    "DQE-Authorization": "{DQE_AUTHORIZATION_KEY}",
    "Content-Type": "application/json"
  },
  body: JSON.stringify({
    orgId: "00D5e0000008abcEAA",
    crt: "2026-10-28T10:15:00Z",
    sub: "0055e00000AbCnoFAF",
    aud: "dqe-unify-api",
    urllogin: "https://login.salesforce.com"
  })
})
  .then(r => r.json())
  .then(data => console.log(data));

import requests

response = requests.post(
    "https://{DOMAIN}/getOAuthTokenForProcess",
    headers={
        "DQE-Authorization": "{DQE_AUTHORIZATION_KEY}",
    },
    json={
        "orgId": "00D5e0000008abcEAA",
        "crt": "2026-10-28T10:15:00Z",
        "sub": "0055e00000AbCnoFAF",
        "aud": "dqe-unify-api",
        "urllogin": "https://login.salesforce.com",
    },
)
print(response.json())

<?php
$data = [
    'orgId' => '00D5e0000008abcEAA',
    'crt' => '2026-10-28T10:15:00Z',
    'sub' => '0055e00000AbCnoFAF',
    'aud' => 'dqe-unify-api',
    'urllogin' => 'https://login.salesforce.com',
];

$ch = curl_init("https://{DOMAIN}/getOAuthTokenForProcess");
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode($data));
curl_setopt($ch, CURLOPT_HTTPHEADER, [
    'DQE-Authorization: {DQE_AUTHORIZATION_KEY}',
    'Content-Type: application/json',
]);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
$response = curl_exec($ch);
curl_close($ch);

$result = json_decode($response, true);

const axios = require('axios');

axios.post('https://{DOMAIN}/getOAuthTokenForProcess', {
  orgId: '00D5e0000008abcEAA',
  crt: '2026-10-28T10:15:00Z',
  sub: '0055e00000AbCnoFAF',
  aud: 'dqe-unify-api',
  urllogin: 'https://login.salesforce.com'
}, {
  headers: {
    'DQE-Authorization': '{DQE_AUTHORIZATION_KEY}',
    'Content-Type': 'application/json'
  }
})
  .then(response => console.log(response.data));

HttpClient client = HttpClient.newHttpClient();

String body = "{\"orgId\":\"00D5e0000008abcEAA\",\"crt\":\"2026-10-28T10:15:00Z\",\"sub\":\"0055e00000AbCnoFAF\",\"aud\":\"dqe-unify-api\",\"urllogin\":\"https://login.salesforce.com\"}";

HttpRequest request = HttpRequest.newBuilder()
    .uri(URI.create("https://{DOMAIN}/getOAuthTokenForProcess"))
    .header("DQE-Authorization", "{DQE_AUTHORIZATION_KEY}")
    .header("Content-Type", "application/json")
    .POST(HttpRequest.BodyPublishers.ofString(body))
    .build();

HttpResponse<String> response = client.send(request, HttpResponse.BodyHandlers.ofString());
System.out.println(response.body());

using var client = new HttpClient();

var json = "{\"orgId\":\"00D5e0000008abcEAA\",\"crt\":\"2026-10-28T10:15:00Z\",\"sub\":\"0055e00000AbCnoFAF\",\"aud\":\"dqe-unify-api\",\"urllogin\":\"https://login.salesforce.com\"}";
var content = new StringContent(json, Encoding.UTF8, "application/json");

using var request = new HttpRequestMessage(HttpMethod.Post, "https://{DOMAIN}/getOAuthTokenForProcess");
request.Headers.Add("DQE-Authorization", "{DQE_AUTHORIZATION_KEY}");
request.Content = content;

var response = await client.SendAsync(request);
var body = await response.Content.ReadAsStringAsync();
Console.WriteLine(body);

package main

import (
    "bytes"
    "fmt"
    "io"
    "net/http"
)

func main() {
    body := []byte(`{"orgId":"00D5e0000008abcEAA","crt":"2026-10-28T10:15:00Z","sub":"0055e00000AbCnoFAF","aud":"dqe-unify-api","urllogin":"https://login.salesforce.com"}`)

    req, _ := http.NewRequest("POST", "https://{DOMAIN}/getOAuthTokenForProcess", bytes.NewBuffer(body))
    req.Header.Set("Content-Type", "application/json")
    req.Header.Set("DQE-Authorization", "{DQE_AUTHORIZATION_KEY}")

    client := &http.Client{}
    resp, err := client.Do(req)
    if err != nil {
        panic(err)
    }
    defer resp.Body.Close()

    respBody, _ := io.ReadAll(resp.Body)
    fmt.Println(string(respBody))
}

Parameters

All fields are sent as a single JSON request body.

Note on Mandatory/Optional: the source OpenAPI specification does not declare a required array for this request body (only the body as a whole is marked required). All fields below are shown as Mandatory based on this project's documentation convention and because each one plays a defined role in the token-issuance flow — confirm actual optionality with DQE engineering before publishing.

Field	Description	Type	Mand / Opt
orgId	The Salesforce organization ID making the request.	String	Mandatory
crt	The created/issued-at timestamp claim for this signed request.	String	Mandatory
sub	The subject claim — the Salesforce user or session identifier issuing the request.	String	Mandatory
aud	The audience claim — the intended recipient/target service for this signed request.	String	Mandatory
urllogin	The Salesforce org's login URL.	String	Mandatory

Response

Returns a JSON object containing the process token.

Key	Description	Type
Token	The generated token, used to authenticate the subsequent process call.	String

Response example

Example token response

{
  "Token": "token"
}

The source specification's only example value for Token is the literal placeholder string "token" — shown as-is above rather than replaced with an invented-looking value.

Errors

The source specification does not define any error responses (4xx/5xx) for this endpoint — only the 200 success response is documented. Confirm actual error behavior with DQE engineering before publishing.

Test the API

Click the button below to test this endpoint live in your browser.

Open console

Subscription - DQE One API

Registers a Salesforce organization or user and returns the credentials needed for subsequent authenticated calls. This looks like an org-onboarding/registration flow rather than a per-call authentication step.

Jump to Parameters Response Example Errors ▶ Test the API

Request

Send a JSON body to this endpoint. No authentication header is required — the source specification declares an empty security requirement for this path.

POSThttps://{DOMAIN}/subscribe

Code examples

cURL JavaScript Python PHP Node.js Java C# Go

curl -X POST "https://{DOMAIN}/subscribe" \
  -H "Content-Type: application/json" \
  -d '{
  "orgId": "00D5e0000008abcEAA",
  "groupId": "GRP-00123",
  "licence": "123456",
  "region": "EU",
  "key": "a1b2c3d4e5f6"
}'

fetch("https://{DOMAIN}/subscribe", {
  method: "POST",
  headers: {
    "Content-Type": "application/json"
  },
  body: JSON.stringify({
    orgId: "00D5e0000008abcEAA",
    groupId: "GRP-00123",
    licence: "123456",
    region: "EU",
    key: "a1b2c3d4e5f6"
  })
})
  .then(r => r.json())
  .then(data => console.log(data));

import requests

response = requests.post(
    "https://{DOMAIN}/subscribe",
    json={
        "orgId": "00D5e0000008abcEAA",
        "groupId": "GRP-00123",
        "licence": "123456",
        "region": "EU",
        "key": "a1b2c3d4e5f6",
    },
)
print(response.json())

<?php
$data = [
    'orgId' => '00D5e0000008abcEAA',
    'groupId' => 'GRP-00123',
    'licence' => '123456',
    'region' => 'EU',
    'key' => 'a1b2c3d4e5f6',
];

$ch = curl_init("https://{DOMAIN}/subscribe");
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode($data));
curl_setopt($ch, CURLOPT_HTTPHEADER, [
    'Content-Type: application/json',
]);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
$response = curl_exec($ch);
curl_close($ch);

$result = json_decode($response, true);

const axios = require('axios');

axios.post('https://{DOMAIN}/subscribe', {
  orgId: '00D5e0000008abcEAA',
  groupId: 'GRP-00123',
  licence: '123456',
  region: 'EU',
  key: 'a1b2c3d4e5f6'
})
  .then(response => console.log(response.data));

HttpClient client = HttpClient.newHttpClient();

String body = "{\"orgId\":\"00D5e0000008abcEAA\",\"groupId\":\"GRP-00123\",\"licence\":\"123456\",\"region\":\"EU\",\"key\":\"a1b2c3d4e5f6\"}";

HttpRequest request = HttpRequest.newBuilder()
    .uri(URI.create("https://{DOMAIN}/subscribe"))
    .header("Content-Type", "application/json")
    .POST(HttpRequest.BodyPublishers.ofString(body))
    .build();

HttpResponse<String> response = client.send(request, HttpResponse.BodyHandlers.ofString());
System.out.println(response.body());

using var client = new HttpClient();

var json = "{\"orgId\":\"00D5e0000008abcEAA\",\"groupId\":\"GRP-00123\",\"licence\":\"123456\",\"region\":\"EU\",\"key\":\"a1b2c3d4e5f6\"}";
var content = new StringContent(json, Encoding.UTF8, "application/json");

var response = await client.PostAsync("https://{DOMAIN}/subscribe", content);
var body = await response.Content.ReadAsStringAsync();
Console.WriteLine(body);

package main

import (
    "bytes"
    "fmt"
    "io"
    "net/http"
)

func main() {
    body := []byte(`{"orgId":"00D5e0000008abcEAA","groupId":"GRP-00123","licence":"123456","region":"EU","key":"a1b2c3d4e5f6"}`)

    req, _ := http.NewRequest("POST", "https://{DOMAIN}/subscribe", bytes.NewBuffer(body))
    req.Header.Set("Content-Type", "application/json")

    client := &http.Client{}
    resp, err := client.Do(req)
    if err != nil {
        panic(err)
    }
    defer resp.Body.Close()

    respBody, _ := io.ReadAll(resp.Body)
    fmt.Println(string(respBody))
}

Parameters

All fields are sent as a single JSON request body.

Note on Mandatory/Optional: the source OpenAPI specification does not declare a required array for this request body (only the body as a whole is marked required). All fields below are shown as Mandatory based on this project's documentation convention — confirm actual optionality with DQE engineering before publishing.

Field	Description	Type	Mand / Opt
orgId	The Salesforce organization ID being registered.	String	Mandatory
groupId	Identifier of the licence group/package instance this organization is being subscribed under.	String	Mandatory
licence	The DQE licence code associated with this subscription.	String	Mandatory
region	The region or data center where this organization's DQE instance should be provisioned.	String	Mandatory
key	An activation or subscription key used to validate the registration request. Inferred from the field name only — its exact purpose is not documented in the source specification.	String	Mandatory

Response

Returns a JSON object containing the credentials issued for this subscription.

Key	Description	Type
pwd	The password issued as part of the new credentials returned by this registration.	String
iss	The issuer identifier assigned to the newly registered organization/user — used as part of the credentials for subsequent authenticated calls.	String
issSecret	The secret paired with the issuer identifier. Store it securely; it authorizes subsequent calls.	String
crt	The created/issued-at timestamp for these credentials.	String
groupId	The group identifier confirmed for this subscription (echoes the request value).	String

Response example

Example subscription response

{
  "pwd": "a8f3c9d21b47e6f0",
  "iss": "UNIFY-00123",
  "issSecret": "9f86d081884c7d659a2feaa0c55ad015",
  "crt": "2026-10-28T10:15:00Z",
  "groupId": "GRP-00123"
}

The source specification gives no example values for this schema. The values above are illustrative placeholders only — no specific format or length is documented.

Errors

Test the API

Click the button below to test this endpoint live in your browser.

Open console

Custom UI Session - DQE One API

Creates a session token for the DQE One package's embedded custom UI, scoped to a specific Salesforce session and user.

customUI/createTokenSession

Jump to Parameters Response Example Errors ▶ Test the API

Request

Send a JSON body to this endpoint with the DQE-Authorization header set.

POSThttps://{DOMAIN}/customUI/createTokenSession

Code examples

Create a custom UI session token

cURL JavaScript Python PHP Node.js Java C# Go

curl -X POST "https://{DOMAIN}/customUI/createTokenSession" \
  -H "DQE-Authorization: {DQE_AUTHORIZATION_KEY}" \
  -H "Content-Type: application/json" \
  -d '{
  "orgId": "00D5e0000008abcEAA",
  "aud": "dqe-unify-api",
  "urllogin": "https://login.salesforce.com",
  "sub": "0055e00000AbCnoFAF",
  "name": "Jane Doe",
  "sessionId": "00D5e0000008abcEAA!AQEAQJ3x9fKZ",
  "licence": "123456",
  "region": "EU",
  "isPersonAccountEnable": false,
  "chatterId": "0D55e00000ABCDEFG",
  "setTokenToUi": true
}'

fetch("https://{DOMAIN}/customUI/createTokenSession", {
  method: "POST",
  headers: {
    "DQE-Authorization": "{DQE_AUTHORIZATION_KEY}",
    "Content-Type": "application/json"
  },
  body: JSON.stringify({
    orgId: "00D5e0000008abcEAA",
    aud: "dqe-unify-api",
    urllogin: "https://login.salesforce.com",
    sub: "0055e00000AbCnoFAF",
    name: "Jane Doe",
    sessionId: "00D5e0000008abcEAA!AQEAQJ3x9fKZ",
    licence: "123456",
    region: "EU",
    isPersonAccountEnable: false,
    chatterId: "0D55e00000ABCDEFG",
    setTokenToUi: true
  })
})
  .then(r => r.json())
  .then(data => console.log(data));

import requests

response = requests.post(
    "https://{DOMAIN}/customUI/createTokenSession",
    headers={
        "DQE-Authorization": "{DQE_AUTHORIZATION_KEY}",
    },
    json={
        "orgId": "00D5e0000008abcEAA",
        "aud": "dqe-unify-api",
        "urllogin": "https://login.salesforce.com",
        "sub": "0055e00000AbCnoFAF",
        "name": "Jane Doe",
        "sessionId": "00D5e0000008abcEAA!AQEAQJ3x9fKZ",
        "licence": "123456",
        "region": "EU",
        "isPersonAccountEnable": False,
        "chatterId": "0D55e00000ABCDEFG",
        "setTokenToUi": True,
    },
)
print(response.json())

<?php
$data = [
    'orgId' => '00D5e0000008abcEAA',
    'aud' => 'dqe-unify-api',
    'urllogin' => 'https://login.salesforce.com',
    'sub' => '0055e00000AbCnoFAF',
    'name' => 'Jane Doe',
    'sessionId' => '00D5e0000008abcEAA!AQEAQJ3x9fKZ',
    'licence' => '123456',
    'region' => 'EU',
    'isPersonAccountEnable' => false,
    'chatterId' => '0D55e00000ABCDEFG',
    'setTokenToUi' => true,
];

$ch = curl_init("https://{DOMAIN}/customUI/createTokenSession");
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode($data));
curl_setopt($ch, CURLOPT_HTTPHEADER, [
    'DQE-Authorization: {DQE_AUTHORIZATION_KEY}',
    'Content-Type: application/json',
]);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
$response = curl_exec($ch);
curl_close($ch);

$result = json_decode($response, true);

const axios = require('axios');

axios.post('https://{DOMAIN}/customUI/createTokenSession', {
  orgId: '00D5e0000008abcEAA',
  aud: 'dqe-unify-api',
  urllogin: 'https://login.salesforce.com',
  sub: '0055e00000AbCnoFAF',
  name: 'Jane Doe',
  sessionId: '00D5e0000008abcEAA!AQEAQJ3x9fKZ',
  licence: '123456',
  region: 'EU',
  isPersonAccountEnable: false,
  chatterId: '0D55e00000ABCDEFG',
  setTokenToUi: true
}, {
  headers: {
    'DQE-Authorization': '{DQE_AUTHORIZATION_KEY}',
    'Content-Type': 'application/json'
  }
})
  .then(response => console.log(response.data));

HttpClient client = HttpClient.newHttpClient();

String body = "{\"orgId\":\"00D5e0000008abcEAA\",\"aud\":\"dqe-unify-api\",\"urllogin\":\"https://login.salesforce.com\",\"sub\":\"0055e00000AbCnoFAF\",\"name\":\"Jane Doe\",\"sessionId\":\"00D5e0000008abcEAA!AQEAQJ3x9fKZ\",\"licence\":\"123456\",\"region\":\"EU\",\"isPersonAccountEnable\":false,\"chatterId\":\"0D55e00000ABCDEFG\",\"setTokenToUi\":true}";

HttpRequest request = HttpRequest.newBuilder()
    .uri(URI.create("https://{DOMAIN}/customUI/createTokenSession"))
    .header("DQE-Authorization", "{DQE_AUTHORIZATION_KEY}")
    .header("Content-Type", "application/json")
    .POST(HttpRequest.BodyPublishers.ofString(body))
    .build();

HttpResponse<String> response = client.send(request, HttpResponse.BodyHandlers.ofString());
System.out.println(response.body());

using var client = new HttpClient();

var json = "{\"orgId\":\"00D5e0000008abcEAA\",\"aud\":\"dqe-unify-api\",\"urllogin\":\"https://login.salesforce.com\",\"sub\":\"0055e00000AbCnoFAF\",\"name\":\"Jane Doe\",\"sessionId\":\"00D5e0000008abcEAA!AQEAQJ3x9fKZ\",\"licence\":\"123456\",\"region\":\"EU\",\"isPersonAccountEnable\":false,\"chatterId\":\"0D55e00000ABCDEFG\",\"setTokenToUi\":true}";
var content = new StringContent(json, Encoding.UTF8, "application/json");

using var request = new HttpRequestMessage(HttpMethod.Post, "https://{DOMAIN}/customUI/createTokenSession");
request.Headers.Add("DQE-Authorization", "{DQE_AUTHORIZATION_KEY}");
request.Content = content;

var response = await client.SendAsync(request);
var body = await response.Content.ReadAsStringAsync();
Console.WriteLine(body);

package main

import (
    "bytes"
    "fmt"
    "io"
    "net/http"
)

func main() {
    body := []byte(`{"orgId":"00D5e0000008abcEAA","aud":"dqe-unify-api","urllogin":"https://login.salesforce.com","sub":"0055e00000AbCnoFAF","name":"Jane Doe","sessionId":"00D5e0000008abcEAA!AQEAQJ3x9fKZ","licence":"123456","region":"EU","isPersonAccountEnable":false,"chatterId":"0D55e00000ABCDEFG","setTokenToUi":true}`)

    req, _ := http.NewRequest("POST", "https://{DOMAIN}/customUI/createTokenSession", bytes.NewBuffer(body))
    req.Header.Set("Content-Type", "application/json")
    req.Header.Set("DQE-Authorization", "{DQE_AUTHORIZATION_KEY}")

    client := &http.Client{}
    resp, err := client.Do(req)
    if err != nil {
        panic(err)
    }
    defer resp.Body.Close()

    respBody, _ := io.ReadAll(resp.Body)
    fmt.Println(string(respBody))
}

Parameters

All fields are sent as a single JSON request body.

Note on Mandatory/Optional: the source OpenAPI specification does not declare a required array for this request body (only the body as a whole is marked required). All fields below are shown as Mandatory based on this project's documentation convention — confirm actual optionality with DQE engineering before publishing.

Field	Description	Type	Mand / Opt
orgId	The Salesforce organization ID making the request.	String	Mandatory
aud	The audience claim — the intended recipient/target service for this signed request.	String	Mandatory
urllogin	The Salesforce org's login URL.	String	Mandatory
sub	The subject claim — the Salesforce user or session identifier issuing the request.	String	Mandatory
name	Display name associated with the session (for example, the Salesforce user's name).	String	Mandatory
sessionId	Identifier of the Salesforce session this custom UI token is bound to.	String	Mandatory
licence	The DQE licence code associated with this organization.	String	Mandatory
region	The region or data center of the Salesforce org or DQE instance.	String	Mandatory
isPersonAccountEnable	Whether Person Accounts are enabled in the calling Salesforce org.	Boolean	Mandatory
chatterId	Identifier of a Salesforce Chatter record (for example, a feed item) associated with this session. Inferred from the field name only — its exact purpose is not documented in the source specification.	String	Mandatory
setTokenToUi	Whether the generated token should be written directly into the custom UI session, rather than only returned in the API response. Inferred from the field name only.	Boolean	Mandatory

Response

Returns a JSON object describing the created custom UI session token.

Key	Description	Type
status	Outcome status of the session-creation request.	String
uuidToken	The generated session token, used to authenticate the custom UI session. The field name suggests a UUID format, but this is not confirmed by the source specification.	String
name	Echoes the session/user name associated with the created token.	String
isUiLocal	Whether the custom UI session is running in local mode rather than against the hosted DQE environment. Inferred from the field name only — not confirmed by the source specification.	Boolean

Response example

Example session token response

{
  "status": "success",
  "uuidToken": "550e8400-e29b-41d4-a716-446655440000",
  "name": "Jane Doe",
  "isUiLocal": false
}

The source specification gives no example values for this schema. The values above are illustrative placeholders only.

DQE One API — Authentication & Session

getOAuthTokenForProcess

Request

Code examples

Parameters

Response

Response example

Errors

Test the API

subscribe

Request

Code examples

Parameters

Response

Response example

Errors

Test the API

customUI/createTokenSession

Request

Code examples

Parameters

Response

Response example

Errors

Test the API

See also

Was this article helpful?

Previous article

Next article