API docs by Redocly

Content Licensing API (1.2.0)

Download OpenAPI specification:

API for Osteocom content licensing partners: read your catalog, record purchases and play videolessons in the Osteocom player.

Call the endpoints in this order:

  1. Login to get the bearer token.
  2. Catalog to read the channels agreed for your account.
  3. Content authorization after a customer pays, to record the purchase and get the customer's userAccessKey. Send your orderId so the call is safe to retry.
  4. Video access to get a 15-minute token for one videolesson, then load it in the player iframe.
  5. Revoke activation to remove a customer's access to a channel.

Every request is a POST with a JSON body. All requests except Login need Authorization: Bearer <token>.

Text fields accept up to 50 characters unless stated otherwise (email 255, orderId 100, userAccessKey 800). A body that fails validation (missing required field, value too long, wrong type) returns 422 with an empty body. Errors don't return JSON: the body is empty or a short text message.

idChannel and videoId are different ids: idChannel identifies the channel you sell, videoId a single videolesson inside it.

Guides: https://platform.developer.osteocom.me/guide/marketplaceapi/ · Postman collection: https://platform.developer.osteocom.me/postman/osteocom-content-licensing.postman_collection.json

Partner login

Login

Exchanges your credentials for the bearer token used by every other request.

Request Body schema: application/json
required
clientId
required
string

Your client ID, provided by Osteocom.

clientSecret
required
string

Your secret key, provided by Osteocom.

Responses

Request samples

Content type
application/json
{
  • "clientId": "psiGBHLDxxxxxxdIyDw",
  • "clientSecret": "QAtSxxxxxxxxrz2JU"
}

Response samples

Content type
application/json
{
  • "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzaWQiOiI2NmZh..."
}

ContentLicensing catalog

Catalog

Returns the channels agreed for your account, each with its videolessons. Titles and descriptions are in the channel's language. Fields without a value are returned as null.

Authorizations:
bearerAuth
Request Body schema: application/json
required
clientId
required
string (ClientId) <= 50 characters

Your client ID, provided by Osteocom.

Responses

Request samples

Content type
application/json
{
  • "clientId": "psiGBHLDxxxxxxdIyDw"
}

Response samples

Content type
application/json
{
  • "catalog": [
    ]
}

ContentLicensing contentAccessAuthorization

Content authorization

Call it after the customer has paid on your platform: it records the purchase and gives the customer access to the channels in products.

The response token is the customer's userAccessKey, needed by Video access. It is always the same for the same userId.

Send your orderId (recommended). A purchase already recorded with the same orderId for your account is not recorded again: the call returns 200 with the same token. You can retry after a timeout or a network error without checking first, and every order maps to exactly one sale. Use a new orderId for every new purchase: a retry never re-grants access revoked in the meantime. Without orderId every call records a new sale.

Authorizations:
bearerAuth
Request Body schema: application/json
required
clientId
required
string (ClientId) <= 50 characters

Your client ID, provided by Osteocom.

userId
required
string (UserId) <= 50 characters

Your id for the customer. Any format, but keep it the same for the same person: Osteocom uses it to match purchases and video access.

email
string or null <= 255 characters

Customer email. Required, and checked for a valid format, only if marketing is enabled on your account.

name
string or null <= 50 characters
surname
string or null <= 50 characters
marketingConsent
boolean
Default: false

Whether the customer agreed to receive marketing (e.g. newsletters).

required
Array of objects (PurchasedProduct) [ 1 .. 100 ] items
orderId
string or null <= 100 characters

Recommended. Your own order number. A purchase already recorded with this orderId for your account is not recorded again: the call returns 200 with the same token and creates no sale and no access. Use a new one for every purchase.

Responses

Request samples

Content type
application/json
{
  • "clientId": "psiGBHLDxxxxxxdIyDw",
  • "userId": "user_12345",
  • "email": "customer@example.com",
  • "name": "Mario",
  • "surname": "Rossi",
  • "marketingConsent": false,
  • "products": [
    ],
  • "orderId": "ORD-2026-000123"
}

Response samples

Content type
application/json
{
  • "token": "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJzdWIiOm51bGwsImlkYyI6InBzaUdC..."
}

ContentLicensing video access

Video access

Returns a token to play one videolesson, valid for 15 minutes. Ask for a new one each time the player is loaded.

Put the token in the player URL:

<iframe src="https://test.osteocom.me/en/videoaccess?signature=TOKEN_AUTH_VIDEO&sublang=en"
        width="100%" height="500" frameborder="0" allowfullscreen allow="encrypted-media"></iframe>

sublang is the default subtitle language (it, en, fr, es). In production use https://www.osteocom.me.

Authorizations:
bearerAuth
Request Body schema: application/json
required
clientId
required
string (ClientId) <= 50 characters

Your client ID, provided by Osteocom.

userId
required
string (UserId) <= 50 characters

Your id for the customer. Any format, but keep it the same for the same person: Osteocom uses it to match purchases and video access.

videoId
required
string <= 50 characters

A videoId from the catalog's video array, not the idChannel.

userAccessKey
required
string <= 800 characters

The token returned by Content authorization for the same userId.

Responses

Request samples

Content type
application/json
{
  • "clientId": "psiGBHLDxxxxxxdIyDw",
  • "userId": "user_12345",
  • "videoId": "66d57a1b5f2a8c1e3f15e4e1",
  • "userAccessKey": "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJzdWIiOm51bGwsImlkYyI6InBzaUdC..."
}

Response samples

Content type
application/json
{
  • "tokenAuthVideo": "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJjaGFubmVsSWQiOiI2NmQ1Nzk2..."
}

ContentLicensing revocate activation

Revoke activation

Removes a customer's access to a channel, for example after a refund. The recorded purchase stays. To give access back, call Content authorization again with a new orderId.

Safe to repeat: when the access is already revoked, the call returns 200 with the date of the original revocation.

Authorizations:
bearerAuth
Request Body schema: application/json
required
clientId
required
string (ClientId) <= 50 characters

Your client ID, provided by Osteocom.

channelId
required
string <= 50 characters

The channel's idChannel.

userId
required
string (UserId) <= 50 characters

Your id for the customer. Any format, but keep it the same for the same person: Osteocom uses it to match purchases and video access.

Responses

Request samples

Content type
application/json
{
  • "clientId": "psiGBHLDxxxxxxdIyDw",
  • "channelId": "66d579675f2a8c1e3f15e4d3",
  • "userId": "user_12345"
}

Response samples

Content type
application/json
{
  • "userId": "user_12345",
  • "cancellationDate": "2026-09-30T10:24:00.000Z"
}