Authentication
Conversational Triage API is authenticated with a bearer token on every request, on both the HTTP and the WebSocket transport.
Authorization: Bearer <token>Tokens are issued and validated — signature, expiry, and OAuth scopes — by the Infermedica API gateway. The same token mechanism covers the whole API; there are no per-endpoint credentials.
Requirements
A request is authorized when all of the following hold:
- the
Authorizationheader carries a valid, unexpired gateway-issued bearer token, - the token grants the
ct:conversationsscope, - the token's
instance_idclaim maps to an API instance provisioned for Conversational Triage.
Obtaining a token follows the same OAuth2 client_credentials flow as the rest of the Infermedica platform — see Platform API authentication for the token endpoint, the Instance-Id header, and how to request scopes.
WebSocket connections
The realtime endpoint authenticates during the upgrade: send the same Authorization header when establishing the connection.
If authentication fails before the upgrade completes, the server closes the socket with WebSocket close code 1008 (policy violation) instead of returning an HTTP error body.
Authentication errors
Failed authentication returns 401 with the standard error envelope:
{
"error": {
"code": "missing_token",
"message": "Authorization header is required."
}
}| Code | Meaning |
|---|---|
missing_token | No Authorization header was sent. |
invalid_token | The bearer token is malformed, or it carries no instance_id. |
unmapped_instance | The resolved instance_id is not a provisioned Conversational Triage instance. |
Instance metadata
Once authenticated, GET /info returns metadata about the instance you are talking to — currently the SNOMED CT version behind the deployed medical model. See Conversations.