API docs by Redocly

Content Licensing API (1.1.1)

Download OpenAPI specification:

API for Osteocom content licensing partners: read your catalog, record purchases and play videolessons in the Osteocom player.

Call the endpoints in this order:

  1. Login to get the bearer token.
  2. Catalog to read the channels agreed for your account.
  3. Content authorization after a customer pays, to record the purchase and get the customer's userAccessKey.
  4. Video access to get a 15-minute token for one videolesson, then load it in the player iframe.
  5. Revoke activation to remove a customer's access to a channel.

Every request is a POST with a JSON body. All requests except Login need Authorization: Bearer <token>.

Text fields accept up to 50 characters unless stated otherwise. A body that fails validation (missing required field, value too long, wrong type) returns 422 with an empty body. Errors don't return JSON: the body is empty or a short text message.

idChannel and videoId are different ids: idChannel identifies the channel you sell, videoId a single videolesson inside it.

Guides: https://platform.developer.osteocom.me/guide/marketplaceapi/ · Postman collection: https://platform.developer.osteocom.me/postman/osteocom-content-licensing.postman_collection.json

Partner login

Login

Exchanges your credentials for the bearer token used by every other request.

Request Body schema: application/json
required
clientId
required
string

Your client ID, provided by Osteocom.

clientSecret
required
string

Your secret key, provided by Osteocom.

Responses

Request samples

Content type
application/json
{
  • "clientId": "psiGBHLDxxxxxxdIyDw",
  • "clientSecret": "QAtSxxxxxxxxrz2JU"
}

Response samples

Content type
application/json
{
  • "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzaWQiOiI2NmZh..."
}

ContentLicensing catalog

Catalog

Returns the channels agreed for your account, each with its videolessons. Titles and descriptions are in the channel's language. Fields without a value are returned as null.

Authorizations:
bearerAuth
Request Body schema: application/json
required
clientId
required
string (ClientId) <= 50 characters

Your client ID, provided by Osteocom.

Responses

Request samples

Content type
application/json
{
  • "clientId": "psiGBHLDxxxxxxdIyDw"
}

Response samples

Content type
application/json
{
  • "catalog": [
    ]
}

ContentLicensing contentAccessAuthorization

Content authorization

Call it after the customer has paid on your platform: it records the purchase and gives the customer access to the channels in products.

The response token is the customer's userAccessKey, needed by Video access. It is always the same for the same userId.

Authorizations:
bearerAuth
Request Body schema: application/json
required
clientId
required
string (ClientId) <= 50 characters

Your client ID, provided by Osteocom.

userId
required
string (UserId) <= 50 characters

Your id for the customer. Any format, but keep it the same for the same person: Osteocom uses it to match purchases and video access.

email
string or null <= 50 characters

Customer email. Required, and checked for a valid format, only if marketing is enabled on your account.

name
string or null <= 50 characters
surname
string or null <= 50 characters
marketingConsent
boolean
Default: false

Whether the customer agreed to receive marketing (e.g. newsletters).

required
Array of objects (PurchasedProduct) [ 1 .. 100 ] items

Responses

Request samples

Content type
application/json
{
  • "clientId": "psiGBHLDxxxxxxdIyDw",
  • "userId": "user_12345",
  • "email": "customer@example.com",
  • "name": "Mario",
  • "surname": "Rossi",
  • "marketingConsent": false,
  • "products": [
    ]
}

Response samples

Content type
application/json
{
  • "token": "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJzdWIiOm51bGwsImlkYyI6InBzaUdC..."
}

ContentLicensing video access

Video access

Returns a token to play one videolesson, valid for 15 minutes. Ask for a new one each time the player is loaded.

Put the token in the player URL:

<iframe src="https://test.osteocom.me/en/videoaccess?signature=TOKEN_AUTH_VIDEO&sublang=en"
        width="100%" height="500" frameborder="0" allowfullscreen allow="encrypted-media"></iframe>

sublang is the default subtitle language (it, en, fr, es). In production use https://www.osteocom.me.

Authorizations:
bearerAuth
Request Body schema: application/json
required
clientId
required
string (ClientId) <= 50 characters

Your client ID, provided by Osteocom.

userId
required
string (UserId) <= 50 characters

Your id for the customer. Any format, but keep it the same for the same person: Osteocom uses it to match purchases and video access.

videoId
required
string <= 50 characters

A videoId from the catalog's video array, not the idChannel.

userAccessKey
required
string <= 800 characters

The token returned by Content authorization for the same userId.

Responses

Request samples

Content type
application/json
{
  • "clientId": "psiGBHLDxxxxxxdIyDw",
  • "userId": "user_12345",
  • "videoId": "66d57a1b5f2a8c1e3f15e4e1",
  • "userAccessKey": "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJzdWIiOm51bGwsImlkYyI6InBzaUdC..."
}

Response samples

Content type
application/json
{
  • "tokenAuthVideo": "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJjaGFubmVsSWQiOiI2NmQ1Nzk2..."
}

ContentLicensing revocate activation

Revoke activation

Removes a customer's access to a channel, for example after a refund. To give access back, call Content authorization again.

Authorizations:
bearerAuth
Request Body schema: application/json
required
clientId
required
string (ClientId) <= 50 characters

Your client ID, provided by Osteocom.

channelId
required
string <= 50 characters

The channel's idChannel.

userId
required
string (UserId) <= 50 characters

Your id for the customer. Any format, but keep it the same for the same person: Osteocom uses it to match purchases and video access.

Responses

Request samples

Content type
application/json
{
  • "clientId": "psiGBHLDxxxxxxdIyDw",
  • "channelId": "66d579675f2a8c1e3f15e4d3",
  • "userId": "user_12345"
}

Response samples

Content type
application/json
{
  • "userId": "user_12345",
  • "cancellationDate": "2026-09-30T10:24:00.000Z"
}