When a Blockchain Platform instance is created, an IDCS application is automatically created and associated with the Blockchain Platform instance. This IDCS application will be called the Blockchain Platform instance application in this topic. This instance application is read-only. To find the instance application from IDCS admin console:

1. Expand the Navigation Drawer and then click Oracle Cloud Services.
2. In the search field, enter the blockchain platform instance name, and then click the search icon. In the results, locate and select the entry. The entry name is in the format of <OBP_instance_name>-<uuid>.
3. You can now generate an OAuth access token either using the web console or via REST API.

   Web console:

   In the IDCS application, on the Details tab, click Generate Access Token. In the dialog select Available Scopes, and click Download Token. The value of field app_access_token in the downloaded token file is an OAuth access token, in which the sub (subject) claim is the name of the current IDCS user who is logged into IDCS admin console.

   REST API:

   In the IDCS application, on the Configuration tab, retrieve the following information:

   • Under General Information, get Client ID and Client Secret.
   • Under Resources, get Primary Audience.

   Invoke the IDCS REST API to generate an OAuth access token:

   curl -u '<client_id>:<client_secret>' \
       https://<IDCS-Service-Instance>.identity.oraclecloud.com/oauth2/v1/token \
       -H 'Content-Type: application/x-www-form-urlencoded;charset=UTF-8' \
       -d "grant_type=password&username=<user_name>&password=<user_password>&scope=<primary_audience>/restproxy"

   Where:

   • <client_id> is the client ID
   • <client_secret> is the client secret
   • <user_name> is the user name of an IDCS user with the REST_CLIENT role
   • <user_password> is the password for the user name
   • <primary_audience> is the primary audience URL
   • <IDCS-Service-Instance> is your identity domain ID. It begins with the characters idcs- and then is followed by a string of numbers and letters, for example, idcs-88c15f1e68604c058062a4220f560123.

   For example:

   curl -u 'myobpinstance-cvirs2oo5e4bpg7pj5kw73oqxcareqrz_APPID:c63b437-1768-4cb6-911e-1e6eg2g3456' \
       https://idcs-88c15f1e68604c058062a4220f560123.identity.oraclecloud.com/oauth2/v1/token \
       -H 'Content-Type: application/x-www-form-urlencoded;charset=UTF-8' \
       -d "grant_type=password&username=obpuser1&password=obppassword1&scope=https://myobpinstance-mytenancy-iad.blockchain.ocp.oraclecloud.com:7443/restproxy"

   The contents of the response body in JSON format will be similar to:

   {"access_token":"<access_token>","token_type":"Bearer","expires_in":3600}

   The value of access_token is an OAuth access token, in which the sub (subject) claim is the <user_name> you used in the request.

When using this authorization flow, note the following:

• Since the Blockchain Platform instance application is read-only, you're not able to import certificate for user assertion. You need to create a new IDCS confidential application as described in the guide. Refer to Create an IDCS Confidential Application for how to add scope for an Blockchain Platform instance
• The aud (audience) claim in the user assertion must include the IDCS audience https://identity.oraclecloud.com/:

  "aud": [
   "https://identity.oraclecloud.com/"
  ],

The REST client can send requests with Authorization: Bearer <OAuth_access_token> in the request header to call the REST API.

curl -i -X GET -H "Authorization: Bearer OAuth_access_token" "https://primary-audience/rest-endpoint-path"

Where:

• OAuth_access_token is the OAuth access token you obtained
• primary-audience is the primary audience URL
• rest-endpoint-path is the relative path that defines the Oracle Blockchain Platform REST resource (note that the identity domain ID of Oracle Identity Cloud Service is used in the path)

For example, the following cURL command retrieves the Oracle Blockchain Platform version.

curl -i -X GET -H "Authorization: Bearer <OAuth_access_token>" https://myobpinstance-mytenancy-iad.blockchain.ocp.oraclecloud.com:7443/restproxy/api/version"