UPS OAuth Authorization Code API Virtual Sandbox

Securely integrate UPS services using OAuth 2.0 Authorization Code and PKCE flows.

The UPS OAuth Authorization Code API enables secure integration of UPS services into business applications. It supports standard Authorization Code and PKCE-enhanced flows, allowing applications to obtain access and refresh tokens without exposing user credentials. This ensures secure, long-term access to protected UPS resources while maintaining operational efficiency through token management.

Use this hosted sandbox to simulate UPS OAuth Authorization Code API APIs without authentication, API keys, or extra dependencies. Point your code or SDK to the Beeceptor base URL, preferably through an environment variable or feature flag, and switch back to the production API when ready. This keeps your integration code consistent across local development, QA, demos, and production.

Use cases:

Use this endpoint to validate OAuth 2.0 handshake flows, including authorization code exchange, PKCE code verifier/challenge verification, and token refresh logic. Developers can simulate successful authentication responses, handle token expiration scenarios, and test the integration of client-side redirect URIs before connecting to the production UPS identity provider.

UPS OAuth Authorization Code API virtual sandbox is up and running!

Use this sandbox URL as the API base in your code to simulate UPS OAuth Authorization Code API responses instantly.

`https://ups-oauth-auth-code.mock.beeceptor.com`

OAuth Auth Code(3 operations)

GET

/v1/oauth/authorize

The Authorize Client endpoint initiates the OAuth Authorization Code flow by redirecting the user to UPS for logging-in and authorize the client application. To begin the authorization flow, the application constructs a URL using the application's client Id, the redirect URI, the scope of permissio

Query Parameter Name	Example
`client_id`*	`id enim proident`
`redirect_uri`*	`nostrud cupidatat id proident`
`response_type`*	`ut do`
`state`	`veniam`
`scope`	`labore officia aliquip nulla sint`
`code_challenge`	`magna nostrud proident`

Request Payload

Response Payload

Missing schema or example in the OpenAPI spec.
Update the definition and recreate the mock server.

{
  "response": {
    "errors": [
      {
        "code": "403",
        "message": "Invalid client ID"
      },
      {
        "code": "500",
        "message": "Token expired"
      },
      {
        "code": "403",
        "message": "Server error"
      },
      {
        "code": "500",
        "message": "Token expired"
      },
      {
        "code": "401",
        "message": "Invalid client ID"
      }
    ]
  }
}

{
  "response": {
    "errors": [
      {
        "code": "500",
        "message": "Server error"
      },
      {
        "code": "403",
        "message": "Unauthorized request"
      }
    ]
  }
}

{
  "response": {
    "errors": [
      {
        "code": "400",
        "message": "Unauthorized request"
      },
      {
        "code": "500",
        "message": "Server error"
      },
      {
        "code": "403",
        "message": "Unauthorized request"
      },
      {
        "code": "400",
        "message": "Unauthorized request"
      }
    ]
  }
}

{
  "response": {
    "errors": [
      {
        "code": "400",
        "message": "Server error"
      },
      {
        "code": "500",
        "message": "Unauthorized request"
      },
      {
        "code": "500",
        "message": "Invalid client ID"
      },
      {
        "code": "403",
        "message": "Token expired"
      }
    ]
  }
}

POST

/v1/oauth/token

The Generate Token endpoint exchanges the authorization code received from the client application for an access token and a refresh token. The client uses the access token to make API requests on behalf of the user by including it in the authorization header. The access token will expire after a ce

Request Payload

{
  "client_id": "23bb0083-1864-4310-bea8-2571483469f8",
  "code": "yFNOisVFFfb6TDhjD6lv",
  "code_verifier": "Nsil3uF1ox5FlWlAsDmRgLf1JKUxQSxyRZ5bs4Mz4Djt1xW6",
  "grant_type": "authorization_code",
  "redirect_uri": "https://winding-conservation.net"
}

Response Payload

{
  "access_token": "iiK8Ee2T5c7P4rKftrIXHReFIDANbag53ZC3IYEdUeiAyf7iMhgt7SUkTqfEtErY",
  "client_id": "b3c3eb03-ec8d-4ff5-9ef2-a8cab40571a5",
  "expires_in": "4",
  "issued_at": "1769257215925",
  "refresh_count": "4",
  "refresh_token": "ubOvp0If4Dbowv0pWxgDXNkUyAdZUqA3G3J9fB4ligz5bqVUFupzBCWAmHdoFnB7",
  "refresh_token_expires_in": "1",
  "refresh_token_issued_at": "1777496506553",
  "refresh_token_status": "pending",
  "scope": "read",
  "status": "approved",
  "token_type": "Bearer"
}

{
  "response": {
    "errors": [
      {
        "code": "401",
        "message": "Unauthorized request"
      },
      {
        "code": "403",
        "message": "Server error"
      },
      {
        "code": "403",
        "message": "Server error"
      },
      {
        "code": "403",
        "message": "Server error"
      },
      {
        "code": "401",
        "message": "Unauthorized request"
      }
    ]
  }
}

{
  "response": {
    "errors": [
      {
        "code": "500",
        "message": "Server error"
      },
      {
        "code": "401",
        "message": "Token expired"
      },
      {
        "code": "403",
        "message": "Token expired"
      },
      {
        "code": "400",
        "message": "Token expired"
      }
    ]
  }
}

{
  "response": {
    "errors": [
      {
        "code": "400",
        "message": "Token expired"
      },
      {
        "code": "500",
        "message": "Server error"
      },
      {
        "code": "403",
        "message": "Unauthorized request"
      }
    ]
  }
}

{
  "response": {
    "errors": [
      {
        "code": "500",
        "message": "Invalid client ID"
      }
    ]
  }
}

POST

/v1/oauth/refresh

The /refresh endpoint is used to refresh an expired access token in order to continue accessing a UPS API on behalf of a user. The endpoint generates a new access/refresh token pair by exchanging a valid refresh token. A successful response returns new access and refresh tokens for ongoing API acce

Request Payload

{
  "grant_type": "authorization_code",
  "refresh_token": "GcBJo6HIS239wSok5afSKuGNvD6NmV5mRmMdNWSRgEc6afqrR2hCCkjIzhJD7mrI"
}

Response Payload

{
  "access_token": "dzjA6DLS2j0uv1iPPxhQaBgSrQLDwWg8xB7xHg3exGN2Ns8mWRGsGGXw0flgQ6Mt",
  "client_id": "5aeeabec-14c1-41ad-b631-76dc9a57edab",
  "expires_in": "6",
  "issued_at": "1779035893844",
  "refresh_count": "4",
  "refresh_token": "OSAmkCXWOaMNdnp9PI5vwJG2hCLih0CLE3C7ngI5Jntyif72ioL3k11LsOr5stTK",
  "refresh_token_expires_in": "4",
  "refresh_token_issued_at": "1771176405458",
  "refresh_token_status": "approved",
  "scope": "write",
  "status": "approved",
  "token_type": "Bearer"
}

{
  "response": {
    "errors": [
      {
        "code": "403",
        "message": "Server error"
      },
      {
        "code": "500",
        "message": "Invalid client ID"
      },
      {
        "code": "401",
        "message": "Server error"
      },
      {
        "code": "403",
        "message": "Invalid client ID"
      }
    ]
  }
}

{
  "response": {
    "errors": [
      {
        "code": "500",
        "message": "Token expired"
      },
      {
        "code": "403",
        "message": "Unauthorized request"
      }
    ]
  }
}

{
  "response": {
    "errors": [
      {
        "code": "500",
        "message": "Token expired"
      },
      {
        "code": "403",
        "message": "Server error"
      },
      {
        "code": "403",
        "message": "Unauthorized request"
      }
    ]
  }
}

{
  "response": {
    "errors": [
      {
        "code": "403",
        "message": "Invalid client ID"
      }
    ]
  }
}

Service Homepage: github.com/UPS-API/api-documentation/blob/main/OAuthAuthCode-Ready.yaml

upsoauthauthenticationshippingsecurity