As noted in the section on REST Integration Authentication, unless otherwise noted, all ServiceBroker API calls must be authenticated using either:

• A fixed, non-expiring System Access Token; or
• A temporary, limited-time use JWT.

Regardless of which approach is used, when API calls require authentication, the Authorization HTTP Header must be set to the string:

• Bearer {token}

where {token} is either a valid System Access Token or a JWT for the desired ServiceBroker Tenant.

Unless otherwise noted in the REST API documentation, the Content-Type HTTP Header must be set to application/json.