---
title: "Private endpoint (JWT OR API key)"
url: "https://console.staging.9fin.com/apis/demo-webapp-staging/versions/ba551c00-5e8d-4520-ae68-9ae9da9ee5fb/operations/getPrivate"
---

> Full API specification: https://console.staging.9fin.com/apis/demo-webapp-staging/versions/ba551c00-5e8d-4520-ae68-9ae9da9ee5fb.md

# Private endpoint (JWT OR API key)

`GET` `/api/private`

Operation ID: `getPrivate`

## Responses

- `200` - Auth result from VerifyToken.verify
- `401` - Unauthorized

## OpenAPI definition

```yaml
openapi: 3.0.3
info:
  title: Demo Web App API
  version: 1.1.8
servers:
  - url: https://{host}/demo
    description: Kong proxy base URL + service base path
    variables:
      host:
        default: api.staging.9fin.com
        description: Self-hosted Demo Gateway from infra-tf PR
paths:
  /api/private:
    get:
      tags:
        - Private
      summary: Private endpoint (JWT OR API key)
      operationId: getPrivate
      security:
        - apiKeyAuth: []
        - bearerAuth: []
      responses:
        "200":
          description: Auth result from VerifyToken.verify
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/PrivateAuthResult"
        "401":
          description: Unauthorized
security:
  - apiKeyAuth: []
  - bearerAuth: []
components:
  schemas:
    PrivateAuthResult:
      type: object
      description: Response is whatever VerifyToken.verify returns.
      additionalProperties: true
  securitySchemes:
    apiKeyAuth:
      type: apiKey
      in: header
      name: apikey
    bearerAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: |
        Bearer access token issued by WorkOS AuthKit. Obtain a token by
        exchanging your DCR-issued `client_id` / `client_secret` at the
        token endpoint, then send it here as `Authorization: Bearer <token>`.

        Token endpoint (staging):
        `https://imaginative-explorer-58-staging.authkit.app/oauth2/token`
```