BNC uses OAuth2 flows for security. When on-boarding to the BNC API platform for the first time, clients are provided with API credentials that allow them to be authenticated and authorised to make API calls. 

With these credentials a user may obtain an access token which must be submitted as a Header with each API request. 

The token will contain the information to permit the client to make the call and the scopes that define which endpoints will be accessible to them depending on their contract.