## 6.1.4.3.2 Call an API
Use the different endpoints of the SAP Authorization and Trust Management service APIs to manage users roles and other authorization configurations.
## Context
Actually, you need two separate URLs. First, you need the token URL to fetch an access token. Next, you can use the API URL to call an API.
To call an API of the SAP Authorization and Trust Management service, you need an access token. See the following example how to retrieve an access token and how to call an endpoint with a cURL request.
On the SAP Business Accelerator Hub , we provide a sandbox system for you to make example calls to the different APIs and their endpoints.
Use the following API URLs:
https://api.authentication.&lt;region&gt;.hana.ondemand.com
##  Note
To find the region, use a btp CLI command, for example btp get accounts/subaccount subaccountid .
## Procedure
1. Configure or program your application to request a token from the OAuth authorization server.
In your call to the OAuth server, you send the client ID and client secret to the token URL appended with the /oauth/token endpoint. To illustrate the call, we use cURL in the following example.
<!-- image -->
```
--data 'grant_type=client_credentials' \ --data 'response_type=token'
```
The authorization server returns a token along with other related information.
```
 Output Code {"access_token":"eyJhbGciOiJSUzI1N...", "token_type":"bearer", "expires_in":43199, "scope":"xs_user.write uaa.resource xs_authorization.read xs_idp.write xs_user.read xs_idp.read xs_authorization.write", "jti":"be340353ac694b4cb504c6823f938647"}
```
2. To retrieve the token, use the following URL:
https://&lt;subdomain&gt;.authentication.&lt;region&gt;.hana.ondemand.com
##  Note
To find the subdomain of the global account, directory, and subaccount, go to the SAP BTP cockpit and display the overview in the Account Explorer .
When you have a token, you can use this token to call the APIs until its validity expires. In this case, simply get a new access token.
3. Use the value of the access\_token property to make calls to the various API endpoints.
4. Call the endpoint of an API.
```
 Sample Code In this example, we request the list of roles of from the authorization API. With the authorization header, use the access token you received in the prerequisites after the key word bearer . curl --request GET \ --url https://api.authentication.eu10.hana.ondemand.com/sap/rest/ authorization/v2/roles \ --header 'Accept: application/json' \ --header 'Authorization: bearer eyJhbGciOiJSUzI1N...'
```
## Results
The API returns the list of roles.
```
 Output Code [ { "roleTemplateName": "Viewer", "roleTemplateAppId": "myapp!t1111", "name": "Viewer", "attributeList": [], "roleCapabilityIDList": [], "description": "Default instance",
```
```
"scopes": [ { "description": "Display forecast", "name": "myapp!t1111.Tourist", "custom-granted-apps": [], "granted-apps": [], "grant-as-authority-to-apps": [], "custom-grant-as-authority-to-apps": [] } ] } ]
```
## Related Information
Authorization and Trust Management APIs on the SAP Business Accelerator Hub Implementing Custom Token Retrieval from SAP Authorization and Trust Management Service with mTLS [page 557]