Authentication

The Placepoint API uses OAuth2 client credentials (RFC 6749, Section 4.4). Your server exchanges a client ID and secret for a short-lived access token, then sends that token as a bearer token on every call.

Getting a trial key

Sign in with GitHub on any docs.placepoint.no/api page for a trial key in under a minute, no payment card. It works today against the Leietaker-API and the current Data API, and the Placepoint API accepts the same key at launch.

Production credentials, a ppk_live_ client id and secret, come from Placepoint. Sandbox credentials are ppk_test_, valid against the same host, data.placepoint.no, restricted to the demo properties on Sandbox.

Requesting a token

Send a POST to /auth/token, application/x-www-form-urlencoded, the four RFC 6749 field names (grant_type, client_id, client_secret, scope) as the platform's one exception to camelCase:

curl -X POST https://data.placepoint.no/auth/token \
  --data-urlencode "grant_type=client_credentials" \
  --data-urlencode "client_id=YOUR_CLIENT_ID" \
  --data-urlencode "client_secret=YOUR_CLIENT_SECRET" \
  --data-urlencode "scope=properties.read companies.read"

{
  "access_token": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...",
  "token_type": "Bearer",
  "expires_in": 3600,
  "scope": "properties.read companies.read"
}

Omit scope to receive every scope your client is granted.

Using the token

curl https://data.placepoint.no/properties/NO/0301-208-15-0-0 \
  -H "Authorization: Bearer YOUR_ACCESS_TOKEN"

Token lifetime

Tokens expire after expires_in seconds (typically 3600). Cache and reuse a token for its full lifetime; request a new one before it expires or on a 401 response.

Scopes

Scopes are space-delimited and dot-separated, <resource>.<action>:

Scope	Grants
`properties.read`	Read properties and their sub-resources.
`companies.read`	Read companies and their sub-resources.
`owners.read`	Person fields on owners, roles and shareholders (PII tier).
`areas.read`	Read area statistics and land allocations.
`subscriptions.write`	Create and delete subscriptions.

owners.read is additive: an operation under properties.read or companies.read still succeeds without it, but a Person owner's, buyer's, or seller's name is omitted, leaving only birthYear when known.

Checking your own identity and quota

curl https://data.placepoint.no/auth/me -H "Authorization: Bearer $TOKEN"

{
  "clientId": "ppk_test_9f2c1a",
  "tier": "STANDARD",
  "scopes": ["properties.read", "companies.read", "areas.read"],
  "dailyCallLimit": 50000,
  "callsToday": 1274
}

See Rate limits and quotas for how dailyCallLimit and callsToday are enforced.

Error responses

A rejected grant returns 400 with an RFC 6749 Section 5.2 body (error, error_description), not Problem Details: this is the one endpoint where the OAuth spec, not the platform's error contract, applies. Every other error follows Errors.

Getting a trial key​

Requesting a token​

Using the token​

Token lifetime​

Scopes​

Checking your own identity and quota​

Error responses​