# Authorizing API Calls in Swagger

> If you are using Swagger to try our API, just log in to your Orchestrator instance in a separate tab.

## Accessing Swagger

If you are using Swagger to try our API, just log in to your Orchestrator instance in a separate tab.

The Orchestrator API Swagger definition can be accessed by adding the `/swagger/ui/index#/` suffix to your Orchestrator URL. For example, https://{yourDomain} `/swagger/ui/index#/`.

:::note
The Swagger authentication expires according to the parameters set in your Orchestrator instance. By default, it is set to 30 minutes. You can change it by modifying the value of the `Auth.Cookie.Expire` parameter, in the `Web.config` file.
:::

## Obtaining an Access Token

To authorize API calls via the Swagger UI for Orchestrator services, perform the following steps:

1. Look for the **Authorize** button at the top right corner of the Orchestrator API page. If the lock is open, you are unauthorized.

   ![docs image](https://dev-assets.cms.uipath.com/assets/images/orchestrator/orchestrator-219801-970087ba.webp)
2. Click **Authorize**. The **Available authorizations** window is displayed.

   :::note
   We currently support one authorization scheme called OAuth2.
   :::

   ![docs image](https://dev-assets.cms.uipath.com/assets/images/orchestrator/orchestrator-219773-ef3a0ff2.webp)
3. All scopes are preselected such that you can experiment with all endpoints in the Orchestrator API. Clear them if you want to restrict access to certain APIs.
4. Click **Authorize**. A new window is displayed confirming you have been authorized.
5. Once done, click **Close** or **X** to close the **Available authorizations** window. The **Authorize** button shows an closed lock meaning you are authorized.

## Sending Requests

While authorized, you can make requests on Orchestrator API resources as follows:

1. Expand an Orchestrator API resource with which you want to perform an operation. The closed lock means that you’re authorized.

   ![docs image](https://dev-assets.cms.uipath.com/assets/images/orchestrator/orchestrator-219805-007d6fd1.webp)
2. In the expanded method window, click **Try it out**.
3. Specify parameter values if required.
4. Click **Execute**. The request is executed. A bearer authorization header is automatically used for your requests.

   ![docs image](https://dev-assets.cms.uipath.com/assets/images/orchestrator/orchestrator-219781-c4b2e0ca.webp)

## Generating a New Access Token

When the access token expires you receive a `401: You are not authenticated!` response. The bearer authorization header is still present for your requests, but the access token is expired. When this happens, you need to invalidate the expired token and generate a new access token:

1. Look for the **Authorize** button at the top right corner of the Orchestrator API page. The lock should be closed.

   ![docs image](https://dev-assets.cms.uipath.com/assets/images/orchestrator/orchestrator-220026-c2fb8f87.webp)
2. Click **Authorize** and on the displayed **Available authorizations** page, click **Logout** to revoke the expired token.

   ![docs image](https://dev-assets.cms.uipath.com/assets/images/orchestrator/orchestrator-220151-386f5a52.webp)
3. Close the **Available authorizations** window by clicking **Close** or **X** and then obtain an access token as described on the Obtaining an access token section.

## Revoking Access

When you're done working with the Swagger UI, you should invalidate the access token you've used:

1. Look for the **Authorize** button at the top right corner of the Orchestrator API page. The lock should be closed, meaning you are authorized.
2. Click **Authorize** and on the displayed **Available authorizations** page, click **Logout**.
3. Close the **Available authorizations** window by clicking **Close** or **X**. The **Authorize** button shows an open lock meaning you are unauthorized.